6 min read
The text-message code you log in with stops working in February
Microsoft retires SMS and voice codes for work accounts on 1 February 2027. There is no opt-out, and the awkward cases are worth finding now.
Insights
Notes on systems, and the businesses that run on them.
Occasional writing from the practice — what we see going wrong, what we would do about it, and the reasoning behind it. No listicles.
6 min readYour IT provider probably is not being regulated. The ones that are will owe you a phone call
The Cyber Security and Resilience Bill covers around 1,500 of the UK's 11,000 IT providers. How to tell which one yours is, and what changes if it is.
6 min readYour website's certificate stopped lasting a year in March, and the next cut is already booked
Certificate lifetimes fell to 200 days in March and halve again in 2027. Renewing is easy. Knowing who receives the expiry warning is the hard part.
6 min readThe login three people share is about to stop working
HMRC switches multi-factor authentication on for every remaining agent account between 28 September and 15 October. Shared logins are what breaks first.
6 min readThis month Google Ads starts writing its own targeting, and nobody has to click yes
From 1 September, Search campaigns using automatically created assets or campaign-level broad match are upgraded to AI Max. No approval required.
5 min readYour IT provider is about to be regulated. Here is what to ask them
The Cyber Security and Resilience Bill will regulate managed IT providers for the first time. Four questions tell you how yours would fare, law or no law.
6 min readYou had multi-factor authentication on. They got in anyway
The attack built to beat MFA wants neither your password nor your code. It takes the session your own successful login produced.
5 min readIn December the office copier stops emailing scans, and nothing will tell you why
At the end of December Microsoft blocks the password sign-in that copiers and apps use to send email through Microsoft 365. The failure is silent.
4 min readThe government built you a free security check. Run it before you pay anyone
The NCSC's free tools give small firms a tailored security fix list in minutes. What they catch, what they cannot see, and when paying makes sense.
5 min readOutlook changed by itself this year. Before you toggle back, count what broke
Microsoft is switching Business plans to new Outlook automatically, but classic is supported until at least 2029. What to check before picking a side.
5 min readYour best client relationship lives on someone's personal WhatsApp
The thread works until the phone goes on holiday or its owner resigns. Who actually holds a client conversation, and three fixes in ascending order of cost.
5 min readSomebody's AI notetaker sat in on that meeting. Whose record is it?
Notetaker bots now join client calls uninvited, and a US lawsuit says one recorded people who never knew. The questions to ask, and the Teams settings.
6 min readFrom October an employment dispute can arrive six months late. Would your records survive the wait?
From 1 October 2026 most tribunal claims can be brought six months after the event. The records that decide them are on shorter timers than that.
4 min readThe .uk transfer system is being retired. Find out who holds your domain before it is
From 9 February 2027 a .uk domain transfers by auth code, like a .com. If yours sits with an ex web designer, the months before that are the time to act.
5 min readSince 2 August, your chatbot may be legally required to admit it is a bot
New EU transparency rules for chatbots took effect on 2 August. Whether they reach your firm depends on who you serve. Disclose anyway, and here is how.
5 min readIn 2029 a PDF stops being an invoice, and the decisions that matter happen this year
From April 2029, most UK invoices between businesses must be structured e-invoices, not PDFs. Nothing to buy yet, but some decisions age badly.
6 min readThe most expensive email your business will receive says a supplier's bank details have changed
Payment diversion fraud now arrives mid-thread, from the supplier's real address. The fix is a rule about process, not sharper eyes.
6 min readAsking for Google reviews is now regulated, and three habits that feel harmless are on the banned list
A discount code for reviews, a form that filters out the unhappy, a quiet word with staff. All three now sit under a law with fines of up to 10% of turnover.
6 min readCyber Essentials got stricter in April, and last year's pass is not this year's
Three questions can now fail your whole assessment on their own. If you passed comfortably last year, that tells you less than it used to.
6 min readThe MTD deadline is the scammers' deadline too
HMRC does send texts and does put QR codes in letters, so "HMRC would never contact you" is bad advice. Here is what it actually never does.
5 min readYour web designer owns your domain, and you find out at the worst moment
The commonest website emergency is not a hack, it is a handover. A five-minute audit tells you who really controls your domain while asking is still easy.
6 min readAI has not eaten local search, and the panic is pointed at the wrong thing
The statistics people quote at you disagree by a factor of three. What wins the searches that bring customers in has barely changed, and it is duller.
6 min readThe spreadsheet that became a system
Most businesses have one file nobody dares touch. How to tell when a spreadsheet has quietly become a system, and what the cheapest exit looks like.
5 min readYour quote went to their junk folder, and it is your domain's fault
The big mailbox providers now reject email they cannot verify. Most small business domains were set up before the rules, and it shows in the junk folder.
5 min readWhen to replace a system rather than integrate it
Integration is usually the cheaper answer, and sometimes the wrong one. The test is whether the old system still describes how your business works.
6 min readThe cookie banner on your website is probably blocking the wrong thing
The UK rules changed in February. Most small business banners now hold back the analytics you rely on and wave the advertising tags straight through.
3 min readWhat an IT consultant should tell you in the first hour
Most first meetings are a sales call wearing a discovery hat. Here is what a useful one covers instead, and the three answers worth listening for.