Shared logins in the office: the risks and safer options

Why shared logins creep in

In a small office, sharing starts innocently. The reception email is used by whoever is on the front desk. The courier account was set up by someone years ago and everyone uses it. The bank's online login belongs to the owner, but the office manager knows the password to make payments. Before long, a handful of passwords are known by most of the team and written on a card in the drawer. It feels efficient, and for a while nothing goes wrong. The cost shows up later, usually when someone leaves, an account is misused, or a supplier asks who placed an order and nobody can say.

The risks of sharing passwords

When several people use one login, there's no record of which person did what. If a fraudulent payment is made, a file is deleted or a rude email goes to a customer, you can't tell who was responsible, or whether it was an outsider. That makes investigations harder and can complicate insurance claims.

Shared passwords are also rarely changed, because changing them means telling everyone. So when a staff member leaves, they often keep working access to email, systems and supplier accounts for months or years. Shared accounts frequently skip multi-factor sign-in too, because the code would go to one person's phone, which makes them easier targets for attackers.

Shared mailboxes instead of shared email logins

In Microsoft 365, a shared mailbox such as accounts@ or info@ doesn't need its own password at all. Staff who need it are given access through their own accounts, and the mailbox appears in their Outlook. When someone leaves, you remove their access and the mailbox carries on. Google Workspace offers similar options through groups and delegated access.

This also means every person signs in with their own multi-factor protected account, and you can see who sent which message. Converting a shared login into a proper shared mailbox is usually straightforward and is one of the quickest security wins in a small office. Before you switch, check which other services use the shared address to sign in, such as supplier portals or subscriptions, so nothing breaks when its password stops being used.

Individual accounts on business systems

Accounting software, payroll, CRM, practice management and most business apps let you add individual users, often with different permission levels. Use that feature rather than one office login. Xero, for example, lets you invite each person with their own role, so one person can enter bills while another approves payments.

Some services charge per user, which tempts businesses to share one account. Weigh that cost against the risks above. Where the service supports it, signing in with your Microsoft 365 or Google account adds central control: disable the person's work account and their access to linked apps goes with it.

Banking: never share the owner's login

Business banking is one place where sharing a login is particularly risky. Most NZ business banking platforms let you set up separate users with their own logins and limits, such as one person who can create payments and another who approves them. That's both safer and easier to manage than an office manager using the owner's credentials. Sharing banking logins may also affect what your bank will cover if fraud occurs, because it often breaches their terms. Check your bank's business banking terms and set up proper user access if you haven't already.

When an account genuinely must be shared

Some accounts only allow one login, such as certain supplier portals, social media accounts or government services. For these, store the password in a business password manager's shared vault, give access only to the people who need it, and turn on multi-factor sign-in, using an authenticator that can be shared securely through the password manager if needed. Keep a list of these shared accounts and who has access. When anyone with access leaves, change the password and update the vault. Because the password lives in the vault, changing it no longer means telling everyone individually.

Admin accounts are a special case

The administrator accounts for Microsoft 365, your domain, firewall and servers should never be shared casually. Each admin should have a personal admin account separate from their everyday account, protected with strong multi-factor sign-in. Keep at least one emergency admin account, with its credentials stored securely and used only if normal access fails. If your IT provider manages your systems, they should use their own named admin accounts rather than a shared 'admin' login, so their activity is recorded too. Ask how they handle this.