Who holds your company's passwords?
Your domain, pages and bank login were set up by different people over the years. How to list them, move them to the company and keep them there.
The Facebook page was opened by the designer who made your first logo. The domain was registered by the developer who built the old website. Instagram still sends its login codes to the phone of a salesperson who left two years ago. None of this causes trouble until the day you need to change something and the code goes to a number nobody in the office answers.
This is normal for a company that has grown over several years, and putting it in order costs almost nothing.
The accounts that are the company
Most logins are a convenience. Lose one of these and clients can no longer find you, write to you or pay you:
- The domain name. Whoever controls it controls the website and every email address on it. See how companies lose their own domain name.
- Email administration, the panel where mailboxes are created and passwords reset. Reset links for most other accounts arrive by email, so this panel opens the rest.
- The Facebook and Instagram pages, and the Meta business account that holds them and the advertising.
- The Google Business Profile: your pin on the map, opening hours and reviews.
- Hosting, where the website's files and databases sit.
- The payment gateway and online banking.
How these accounts are usually lost
Theft by a stranger is the rare case. The common causes are ordinary:
- The account was created with an employee's personal Gmail address or mobile number, because that was fastest on the day.
- The password was posted in a WhatsApp group and stays in the phone of everyone who was ever in it.
- One password is used everywhere, so a leak from the weakest site opens the rest.
- Login codes go by text message to the phone of someone who has left.
- There is one administrator, and nobody else can get in if that person falls ill or resigns on bad terms.
Each of these made sense at the time, and the fix is the same for all: move the account from a person to the company.
Putting it in order in six steps
- List every account and who can get in. Include accounts opened by agencies and freelancers. Note the email address and phone number each is registered to, then try each login yourself.
- Move ownership to addresses on the company's domain. Use role addresses such as
admin@your-company.com, read by more than one person, instead of one employee's address. If the company still runs on free mailboxes, change that first, for the reasons in why your business email shouldn't be @gmail.com. - Give every critical account two administrators, usually the owner and one trusted manager. An agency or freelancer needs enough access to do the work, without owning the account. Facebook differs: a page is managed through people's own profiles, so the owner should personally hold full control of the Meta business account, with one other person.
- Use a password manager with a shared vault. Staff open the vault and the password is filled in for them, so nobody sends it in a message. When someone leaves, remove them from the vault and change the passwords they could see.
- Turn on two-factor authentication with an authenticator app, and store the backup codes somewhere safe.
- Review recovery details. Every account has a recovery email address and phone number, set once and forgotten. Whoever receives the recovery message can reset the password, so replace personal details with company ones.
These steps do not make an account impossible to lose, but they close the ordinary routes to losing it.
Two-factor authentication: app or text message
Two-factor authentication means the account asks for a short code after the password, from an authenticator app or by text message.
The app is the stronger choice, because it produces the code on the phone itself. A text message depends on a phone line: the SIM can be lost or replaced, and a line left to expire may be given to someone else. Even so, text-message codes are far better than no second step. If an account offers nothing else, turn them on, with a number the company owns.
When you enable the app, most services give you backup codes for the day the phone is lost or broken. Print them and keep them in the safe, or one broken phone can lock the company out of its own account.
An inventory table you can copy
One page is enough, kept where only the owner and one other person can reach it. It holds no passwords. The entries are examples.
| Account | Owner address | Administrators | Two-factor | Recovery |
|---|---|---|---|---|
| Domain name, email administration | admin@your-company.com | Owner, IT manager | App | Company mobile, outside address |
| Hosting | admin@your-company.com | Owner, IT manager | App | Company mobile |
| Facebook, Instagram, Meta business account | marketing@your-company.com | Owner, marketing manager | App | Company mobile |
| Google Business Profile | marketing@your-company.com | Owner, marketing manager | App | Company mobile |
| Payment gateway, online banking | accounts@your-company.com | Owner, finance manager | Text message or the bank's method | Company mobile, the branch |
The outside address in the first row is one the owner controls off the company's domain. If the domain lapses, a reset message sent to an address on it does not arrive.
The day someone leaves
Do this on the person's last working day, while they are still there to help.
- Remove their access to every account on the inventory and to the password vault.
- Change every shared password they knew.
- Move ownership of anything still registered to their personal email or number.
- Check the recovery addresses and phone numbers for their details.
- Close or redirect their company mailbox, so client mail still reaches someone.
Make it a standard procedure for everyone, like handing back the keys, so nobody reads it as an accusation.
The fake "policy violation" message
Sooner or later, whoever runs a business page receives a message that says roughly this: your page has violated our policies and will be removed unless you verify your account today. The link opens a page that looks like Facebook and asks for the email, the password and then the login code. Whoever types them in hands over the page and the advertising account attached to it.
How to recognise it:
- Meta does not ask for your password through a message.
- Check the address in the browser before typing anything. Fake pages use addresses that resemble the real one, with an extra word or a different ending.
- If you are unsure, leave the link alone. Open the app yourself and look for the warning there.
Show an example to everyone who has a role on the page. An authenticator app helps here but does not replace attention, because the fake page asks for the code as well.
Where to start this week
Start with the inventory, then fix the email, because almost every other account is registered to an address. PearlFibers business email gives you mailboxes and aliases on your own domain, with mailboxes created and reset from your portal, so the address belongs to the company and stays when staff change. And Loop puts drive, mail, chat, calendar, tasks and contacts under one account and one admin, so a new employee means creating one user and a departure means closing one.