It almost always starts as a quick, practical fix. A team member urgently needs access to an online portal, an accounting system, or the company website, so someone simply forwards over the existing username and password.
The username might be a generic “admin,” an “accounts@” email, or even the name of an employee who left the business years ago. The password quickly ends up saved in a web browser, scribbled in a shared document, or buried in a Slack thread. The employee signs in, gets the job done, and everyone moves on.
The serious problems usually surface much later. A customer record is mysteriously deleted, a crucial payment instruction is altered, or you receive an alert about a login from a suspicious location. When you check the account history, every single action is logged under that one shared username. Multiple current employees know the password, former staff might still have it memorised, and absolutely nobody can confidently identify who actually used the account.
While sharing a login feels like an easy shortcut, it fundamentally breaks your security and makes the account incredibly difficult to manage.
Why Businesses End Up with Shared Logins
Most companies do not deliberately set out to create a messy web of shared passwords.
Often, a piece of software is purchased when the business only has two employees. As the team grows, simply passing that original login around feels much easier than upgrading the subscription plan or creating separate user profiles. In other cases, the software might not even support multiple users, or nobody has taken the time to properly configure the access settings.
Shared accounts also frequently crop up when a team monitors a central email address (like sales@ or support@) because nobody has shown them how to properly set up a delegated “shared mailbox”. Just because this workaround has functioned for years does not make it safe.
You Cannot Reliably See Who Did What
When five different people sign in using the exact same login credentials, the software records all their activity under a single identity.
You might be able to see that “Admin” signed in and downloaded a sensitive report, but you have no way of knowing which of your five employees was actually sitting at the keyboard. This causes major headaches for everyday troubleshooting, but it becomes a critical emergency if you suspect fraudulent activity. If a client database is exported, you must know definitively whether it was a current employee, a former employee, or an outside attacker.
The UK National Cyber Security Centre (NCSC) explicitly recommends giving every employee a separate work account so that actions can be traced to a specific individual.
One Password Exposes Everything
To share an account, the password has to physically reach every person who needs it.
This means the password gets copied into emails, pasted into group chats, or saved across multiple unmanaged devices. Each extra copy creates another vulnerability. If just one employee enters that shared password on a malware-infected laptop, an attacker instantly gains the exact same access as your entire team.
Furthermore, because multiple people legitimately log in at different times, a genuine cyberattack might be completely ignored and dismissed as “just another employee working from home”.
Shared Logins Make Offboarding a Nightmare
When a staff member with their own dedicated account leaves your company, your IT provider can disable their access instantly without affecting anyone else.
With a shared login, the departing employee knows the password. To truly revoke their access, you have to change the password and manually distribute the new one to everyone who is still authorised to use it. Because this process is incredibly frustrating, many businesses simply skip it—leaving former employees with permanent, unchecked access to company systems.
MFA is Almost Impossible to Manage
Multi-Factor Authentication (MFA) requires a secondary proof of identity, like a code from a smartphone app, to complete a login.
MFA is designed to verify the specific individual signing in. When an account is shared, the MFA prompt usually goes to one specific employee’s phone. This leads to staff dangerously forwarding secure codes to one another, or worse, leaving a “shared” company mobile phone sitting on an office desk for anyone to access. Individual accounts ensure everyone has their own secure, manageable MFA method.
Everyone Gets the Same Permissions
When several people share an account, they all inherit whatever permissions that account holds.
An intern who just needs to view a customer’s address might be logging in with an account that also has the power to permanently delete the database. Individual accounts allow you to enforce the “principle of least privilege,” meaning each person only receives the exact level of access they need to perform their specific job.
A Shared Mailbox Doesn’t Need a Shared Password
If your team needs to monitor a generic address like [email protected], they absolutely do not need to share a password.
Modern platforms like Microsoft 365 allow administrators to create a “shared mailbox” that employees can open directly from within their own personal email accounts. Each person logs in with their own unique identity, and their access to the shared inbox can be added or removed instantly without ever changing a password.
Admin Passwords Should Never Be Passed Around
Shared administrator logins are exceptionally dangerous because they hold the keys to your security settings, user management, and sensitive billing information. If an admin password is stolen or misused, the attacker can lock you out of your own business. Give each administrator a named account, and ensure they use a standard account for their everyday tasks.
What if the Software Only Allows One Login?
Some older applications or cheap software tiers restrict you to a single login.
If you absolutely cannot replace the software, the shared credentials should be locked inside a secure business password manager. Do not send the password via email or chat. A password manager allows you to grant access to a restricted group of employees, and many systems will record exactly who used the credential. Always change this password immediately when someone leaves the group.
Service Accounts Are Different
Your IT provider might set up “service accounts,” which are logins used by automated software or backup systems to communicate with your servers. These are very different from employee logins.
A service account should have strictly limited permissions, a documented owner, and credentials that are completely hidden from normal staff.
How to Replace Shared Logins Without Disrupting Work
- Audit your accounts: List all the systems your business uses, including social media, accounting, cloud storage, and marketing tools.
- Identify the users: Document exactly who currently uses each account and why.
- Create named accounts: Wherever the software allows, set up individual profiles for each employee and restrict their permissions to only what they need.
- Enforce MFA: Turn on Multi-Factor Authentication for every new individual account.
- Use a password manager: For the few accounts that strictly limit you to one login, move the credentials into a business password manager and restrict who can see them.
Frequently Asked Questions
Is it ever acceptable to use a shared login?
Only if an older application strictly limits you to one account and cannot be replaced. In these rare cases, restrict access heavily, use a business password manager, monitor the account, and change the password immediately whenever an employee leaves.
Can we share an account if MFA is enabled?
MFA stops outside attackers from using a stolen password, but it does not restore internal accountability. Because several people are still using one identity, you still cannot trace who made specific changes.
Are shared email addresses unsafe?
The generic address itself (like info@) is perfectly fine. The danger is giving everyone the password to log into it. Employees should always access shared addresses through a delegated connection inside their own personal work accounts.
Do we need to replace every shared account at once?
Start by identifying accounts that hold administrator privileges or sensitive financial and customer data. Secure those first, and then work through the remaining accounts based on their risk level.
What should we do when an employee leaves?
Disable their individual accounts immediately. If they had access to any unavoidable shared passwords, you must change those passwords right away and audit the accounts to ensure they haven’t left any backdoor recovery methods behind.
Don’t let poor access controls compromise your business
Untangling years of shared passwords and messy permissions doesn’t have to be a nightmare. If you want to secure your team’s access and establish crystal-clear accountability across your systems, Novo IT is here to help. As a family-run business based in Crawley, we provide proactive Cybersecurity and Managed IT Services to small businesses across West Sussex. We can audit your current logins, set up secure shared mailboxes, implement enterprise-grade password managers, and ensure your data remains completely secure.
👉 Ready to take control of your business security? Book your Free IT Audit today, and let our friendly, expert team secure your access.
Article used with permission from The Technology Press.
Comments are closed