Shared Logins Feel Convenient—Until Someone Leaves

Why one shared password creates several problems

A shared login hides individual responsibility. If three people use the same username, the service may show that “the account” changed a payee, downloaded a customer list or deleted a file—but not which person did it.

The Office of the Australian Information Commissioner gives the same risk practical weight in its security guidance: a shared store login can leave a business with no way to track or audit who accessed personal information. This is not only untidy account management; where customer information is involved, it can weaken a business’s ability to understand and respond to an incident.

• You cannot remove one person cleanly. The password must be changed for everyone, across every device where it may be saved.
• The password spreads. It ends up in messages, notebooks, browser storage or spreadsheets because the team needs an easy way to pass it around.
• Multi-factor authentication becomes awkward. Approval prompts or recovery codes may depend on one person’s phone.
• Access outlives the job. Former staff, contractors, bookkeepers and IT providers may retain a credential long after they need it.
• A compromise has a wider effect. One stolen shared password can expose every function available to that account.

Individual accounts do not mean everyone gets more access

The safer pattern is a named account for each person, with only the permissions their work requires. Security professionals call this least privilege. For a small business, it means access should match the job.

The Australian Cyber Security Centre recommends restricting privileged access to people with a demonstrated business need. It also notes that fewer privileged accounts mean fewer opportunities for criminals to obtain powerful credentials.

• The person raising invoices may not need permission to change bank details.
• A social-media contributor may not need ownership of the business page.
• A bookkeeper may need accounting access without access to email administration.
• An owner may use a normal account every day and a separate administrator account only for deliberate changes.

Individual accounts improve both security and ordinary management: permissions can change without interrupting everyone else, and activity records are more useful when something needs checking.

Use team features instead of passing around the password

Many services provide roles, delegated access or team membership. These options may cost more than a single-user plan, but they let the business remove one person without resetting everybody and may provide a clearer record of activity.

Look for:

• named users with separate sign-ins;
• owner, administrator, editor, billing or read-only roles;
• the ability to require multi-factor authentication;
• activity or audit records;
• central recovery contacts controlled by the business; and
• a clear process for suspending or deleting a user.

Do not automatically make every named user an administrator. A separate login is useful only when its permissions are also proportionate.

Shared vault is not the same as shared account

A reputable business password manager can share access to a credential without putting the password in chat, email or a spreadsheet. That is safer than informal sharing, but it does not turn a shared service account into an individual one.

Use a shared vault when the service genuinely provides only one business credential or while you are moving to a better arrangement. Protect the vault with strong authentication, limit membership and review who can reveal, edit or export credentials.

Where the service supports named users, prefer them. The password manager can then store each person’s unique strong password or passkey and can hold recovery information under business control.

Plan for leave and emergencies as well as departures

A business should not lose access because the only administrator is ill, travelling or has lost a phone. At the same time, the answer is not to give everybody permanent administrator rights.

• Keep at least one controlled recovery route that belongs to the business.
• Nominate a backup administrator where the platform and business size make that sensible.
• Store recovery codes securely and separately from the device used for sign-in.
• Document which provider or trusted person can help without recording secret values in the procedure.
• Test the recovery route before an emergency.

If you cannot remove shared logins immediately

Some tills, legacy systems and supplier portals may not support proper team access. Reduce the risk while you investigate alternatives:

• keep the credential in a protected business password manager rather than messages or paper;
• limit who can access the shared vault entry;
• turn on multi-factor authentication where practical and keep recovery under business control;
• change the password whenever somebody with access leaves;
• do not reuse that password anywhere else;
• review the account’s activity and recovery settings regularly; and
• record the limitation so it does not become a forgotten permanent exception.

A ten-minute access review

Choose one high-consequence service and ask:

1. Who can sign in today?
2. Does each person have their own account?
3. What can each account do?
4. Who can add another user or change recovery details?
5. Do any former staff or suppliers still have access?
6. Could the business recover access if the main administrator were unavailable?

Fix the highest-risk answer, then repeat the review with another service next week. A small, maintained access list is more useful than a large policy nobody updates.

Sources and further reading

• OAIC — Guide to securing personal information
• Cyber.gov.au — Small business cyber security guide
• Cyber.gov.au — Restrict administrative privileges
• Cyber.gov.au — Password managers
• Cyber.gov.au — Multi-factor authentication
• Cyber.gov.au — Protecting your staff

Frequently asked questions