Access to the back office should require multi-factor authentication. Either a text code or authenticator app.