Turn on app based two factor login for your admin team and your customers, force it where you need to, and reset it when someone loses their phone.