Stop sharing work logins: what to use instead

Chidi runs the front office. The shop’s tool for invoices has one login, and it lives on a yellow note stuck to the monitor. Five people use it. One of them leaves in March.

In April, an invoice is changed. Nobody knows who did it. The note is still on the monitor, and so is the old password.

This is a small habit with a big cost. Here is how to change it without making work harder.

Why do shared logins bite?

• No names. If five people use one login, you cannot tell who sent the email or changed the bank details.
• No clean exit. When someone leaves, the password has to change for everyone. Often it does not.
• No limits. One login gives one level of access. A new person gets as much as the boss.
• No privacy. A note, a chat message or a shared sheet can be seen by people it was not meant for.

CISA has a short page on using strong passwords, and the UK’s NCSC explains how password managers work. Both say the same thing in different words: use a long, unique password for each account, and let a tool remember it.

What should you use instead?

1. Your own account. Most tools let you add a person. It takes a few minutes. Ask IT or the owner.
2. A password manager. It keeps long, different passwords for every account. Many let you share an item with a team without anyone seeing the password.
3. Roles, not shared keys. Give each person only the access they need.
4. Two-step sign-in. Turn it on where you can. See CISA’s page on turning on MFA.

If a tool really only has one login, put it in the shared vault and keep a list of who has access. When someone leaves, change the password the same day.

What is the 10-second check?

What do you say when a coworker asks for your login?

They are usually in a hurry and not trying to cause harm. You can be kind and still say no.

• “I cannot share mine, but let us ask IT to set you up.” Short and friendly.
• “Let me do it for you while you watch.” If the task is small and your boss is fine with it, do it yourself. Do not hand over the password.
• “It is in the team vault. I will add you.” If a shared tool is set up that way.
• If the person is your boss: “I can send you the file. Let us get you your own sign-in so it is quick next time.”

If someone you do not know asks for a login by email, chat or phone, that is a scam until proven otherwise. Our guide to spotting a fake email shows the usual tricks, and AI voice scam calls from the boss covers the call version.

What about small teams and shops?

In Nigeria, many small teams share one phone or one account for the shop, the page or the bank app. If you must, write down who has access, turn on two-step sign-in, and never share a bank or POS login. Our post on fake transfer alerts and POS fraud shows why.

In the United States, small offices often share a login for a payroll, tax or billing tool. Many of these let you add users. Do it. If you handle client tax data, the FTC Safeguards Rule applies to you, and one login per person is the easy way to show who touched what. See our post for tax preparers.

What if you already shared a login?

You are not in trouble for telling someone.

1. Change the password now. Make it long and different from your other ones.
2. Remove anyone who should not have it. Including people who left.
3. Tell IT. Say which tool and who had it.
4. Check recent activity. Look for changes or sign-ins you do not recognise.
5. Used it anywhere else? Change those too.
6. Think you were tricked? See what to do after clicking a phishing link.

Keep reading

Related guides: work phone safety habits, public Wi-Fi safety for staff, and guest Wi-Fi and the front desk. Also see the sign-in prompt you did not ask for.

Try it safely

Our free phishing test sends your team safe, made-up phishing emails. It shows who clicked and who typed a password. You can also see how phishing simulation training works.

For managers and owners: staff share logins when the proper way is slow. Make it quick to add a person, and read AkolagTech’s note on why you do not need to change passwords every 90 days.