Sharing passwords at work: the risk and the fix

Key takeaways

Sharing passwords at work happens when several people need one account and nobody has set up proper access. It removes accountability, makes it impossible to revoke one person's access, and leaves the business exposed when someone leaves. Individual logins, a password manager and two-step verification fix it.

• Shared logins mean no record of who did what.
• When 1 person leaves, every shared password should be changed.
• A password manager lets teams share access without revealing passwords.
• Turn on 2-step verification for email and banking first.

Why do small teams share passwords?

Small teams share passwords because it is the quickest way to give someone access. A tool was bought with one licence, a supplier portal allows one login, or the person who set up the account has left. With no one responsible for IT, the workaround becomes the system.

• The hidden costs of doing everything in-house
• Shadow IT in a small business: risks and fixes

What are the risks?

The risks are loss of accountability and loss of control. If five people use one login, you cannot tell who made a change or a payment. You cannot remove one person's access without changing it for everyone, so in practice it is not changed. Passwords kept in spreadsheets, emails or chat can be read by anyone who gets into those.

• No audit trail for actions.
• Former staff retain access.
• One phishing success exposes everyone.
• Two-step verification is hard to use, so it gets switched off.

• The four eyes principle for small businesses

What does the NCSC recommend?

The National Cyber Security Centre publishes password guidance for organisations. It encourages reducing reliance on passwords, using password managers, and turning on two-step verification for important accounts, starting with email. Its Small Business Guide gives a short version suitable for firms with no IT staff.

• Cyber security without an IT department

How do you fix it?

Fix it in order of risk, starting with the accounts that would hurt most if misused.

• List every shared login and who uses it.
• Give individual accounts wherever the service allows.
• Put the remaining shared ones in a business password manager.
• Turn on two-step verification for email, banking and admin accounts.
• Change shared passwords whenever someone leaves.
• Keep two administrators on every critical system.

• Employee handover checklist for small teams

When is a shared login acceptable?

A shared login is acceptable when a service truly offers only one account, provided the password is stored in a password manager, access is limited to those who need it and it is changed when anyone leaves. It should be the exception and it should be recorded.

Which shared logins matter most?

Rank shared logins by what someone could do with them.

• Email: resets every other account.
• Online banking and payment platforms.
• Website and domain administration.
• Social media accounts.
• Accounting, payroll and CRM systems.
• Supplier portals holding payment details.

What does a password manager cost and change?

Business password managers typically cost a few pounds per user per month. For that, each person has one strong password to remember, shared logins sit in a vault with access granted by name, and removing someone takes a click. Staff stop keeping passwords in notebooks and spreadsheets because the manager fills them in automatically. For a team of ten the yearly cost is usually a few hundred pounds.

How does this work with an outside team?

Giving an outside team access should follow the same rules, more strictly. Each person should have a named account with only the permissions the task needs, two-step verification should be on, and activity should be logged. Avoid handing over a shared admin password. A provider who asks for individual, limited access is showing you how they treat security.

What mistakes are most common?

The usual mistakes are reusing one password across several systems, leaving former staff and old suppliers with access, registering business accounts to a personal email address and having a single administrator. Each is quick to fix, and together they account for most of the avoidable risk in a small business's logins.

What does this look like in practice?

A pattern we see in audits: one admin account for the website, shared by three people and a former agency, with a password unchanged for years. Nobody knows who last logged in. Setting up individual accounts takes less than an hour.

• Website security for small businesses
• See client work
• BPO Solutions for UK businesses

Password sharing checklist

Do this over a fortnight.

• Inventory shared logins.
• Create individual accounts where possible.
• Adopt a password manager.
• Enable two-step verification.
• Remove former staff and suppliers.
• Add a leaver step to change shared passwords.

• The hidden cost audit: score your business in an hour

Next step

If you are planning to give an outside team access to your systems, tell us what they would need. We will explain how role-based access and logging work in a 30-minute call.