One email address. One password. Six people. Including the company bank portal.
During an onboarding audit for a property management company in the Valley about 22 employees managing 150 residential units we asked our standard question: "Can you walk us through who has access to what?"
The office manager nodded and said "Sure. We all use the same login."
We thought she meant for one specific system. She didn't.
One Gmail address and one password shared across six people in the front office was the login for their email, their Google Drive, their property management software, their accounting platform and their business bank account's online portal.
Six people. One set of credentials. For everything.
How this happens
It didn't start this way. Originally, the business had one employee who handled everything. One person, one login it made sense at the time. Then they hired a second person and shared the password so she could access the same tools. Then a third. Then a fourth.
Nobody thought about creating individual accounts because the shared login worked. Everyone could access what they needed. There were no lockouts, no permission issues, no complexity. It was easy.
And that ease is exactly what makes it dangerous.
What's actually at risk
When six people share one login, you lose the ability to know who did what. If a file gets deleted, who deleted it? If an email gets sent, who sent it? If a transaction appears in your bank portal that nobody recognizes, who initiated it?
The answer to all of these is: you don't know. You can't know. Because from the system's perspective, every action was taken by the same user.
This also means that if one person's phone gets compromised, or one person writes the password on a sticky note, or one person falls for a phishing email every system that shares that credential is exposed. Simultaneously. Including the bank account.
And when someone leaves the company which had happened twice in the past year the only way to revoke their access is to change the one password that everyone uses. Which means disrupting everyone else's access. Which means, in practice, it doesn't get changed. The former employee walks away with working credentials to the company bank portal.
That's not a hypothetical risk. That's an actual one.
What we did
The first step was creating individual accounts for every person on every platform. Separate email addresses. Separate logins for the property management software. Individual user accounts for the accounting platform. And critically, role based access to the bank portal with each user having their own credentials and only the access level appropriate for their role.
This took time. It meant working with each platform's admin settings, migrating shared data to properly permissioned individual accounts and training each employee on their new credentials. It wasn't glamorous. It was necessary.
We set up MFA on every account. We configured a password manager so nobody needed to memorize sixteen different passwords. And we documented the entire access structure so it's clear who has access to what and at what level.
The second step was establishing a process for adding and removing access. When someone new starts, they get their own accounts with appropriate permissions set up before their first day. When someone leaves, their access is revoked across every platform within hours. No shared passwords to change. No uncertainty about what they can still log into.
Where they are now
Six months later, the office manager told us that the individual accounts actually made everyone's job easier, not harder. People stopped accidentally overwriting each other's work in shared documents. Email conversations became trackable. And the constant low grade anxiety about "who has access to what" was gone because the answer was clear and documented.
The bank portal change was the one the owner cared about most. He told us he'd never thought about the risk until we laid it out and then he couldn't stop thinking about it until it was fixed.
That's usually how it goes. The risk you don't see is the one that keeps growing.