Shared Accounts and Why They Cause Problems
One login used by the whole team is convenient until something goes wrong. Why shared accounts cause security and accountability problems, and safer alternatives.
"Just use the office login" is common in small businesses: one account for the social media page, the supplier portal or the shared inbox. It feels efficient. It is also one of the easiest ways to lose control of your accounts.
The problems
- No accountability: you cannot tell who changed what.
- Passwords spread to personal phones, notes and messages.
- Former staff keep access because the password never changes. See former staff access.
- Two-step verification is awkward, so it is often switched off.
Safer alternatives
- Individual accounts with roles, where the service supports it.
- Delegated access to shared mailboxes and business pages. See business social media.
- A password manager for the few logins that must be shared. See business password managers.
- Single sign-on as you grow. See single sign-on.
If you must share, keep the list of people short, turn on two-step verification, and change the password whenever someone leaves.
For more, see protecting small businesses from digital threats.
Frequently asked questions
Why are shared accounts risky?
You cannot tell who did what, passwords spread and rarely change, two-step verification is awkward, and former staff often keep access.
What about shared mailboxes like info@ or sales@?
Most email services let you give individual users access to a shared mailbox without sharing a password.
What if a service only allows one login?
Store it in a business password manager, turn on two-step verification, and change it when anyone with access leaves.
Sources
- 10 Steps to Cyber Security, UK National Cyber Security Centre
- Use Strong Passwords, US Cybersecurity and Infrastructure Security Agency
- Small organisations guide to cyber security, UK National Cyber Security Centre
