Many small businesses still share logins with Virtual Assistants, OBMs, bookkeepers, web designers and outsourced team members.
Sometimes it happens because software charges extra for additional users. Sometimes it is because the client is busy, overwhelmed or trying to keep costs down. And sometimes it is simply because nobody has stopped to think through what happens when several people all log in as the same person.
The problem is that shared logins create confusion very quickly when something goes wrong.
If multiple people use the same account:
- the system often cannot tell who made a change
- audit trails become unreliable
- fraud investigations become harder
- assistants can be blamed for actions they did not take
- clients may struggle to prove fraudulent activity to insurers, banks or platforms
This becomes even more important when personal data, payment systems, financial settings or customer databases are involved.
This article focuses on the practical realities of shared logins in modern online businesses and outsourced teams.
We covered some of the wider GDPR and password-sharing foundations in our earlier article:
https://koffeeklatch.co.uk/should-you-share-passwords-in-a-gdpr-world/
Why businesses still share logins
Most business owners are not deliberately ignoring security risks. Usually, they are trying to keep the business moving.
Common reasons include:
- software charging extra for additional users
- platforms hiding team permissions behind expensive plans
- rushed onboarding of assistants or associates
- holiday cover and emergency delegation
- lack of technical confidence
- the belief that “it’s only me and my VA”
Some business owners also assume that password managers solve the problem completely.
Password-sharing tools are usually safer than emailing passwords around, but they do not automatically solve issues around accountability, audit trails or user identity.
The core problem remains the same:
when several people all appear to be the same user, the system cannot clearly separate responsibility.
What actually goes wrong when people share logins
Shared logins do not usually cause problems immediately. That is why businesses continue doing it. We get a bit cosy thinking “it has never caused me a problem before”.
The difficulties appear later, when somebody:
- changes a setting
- updates payment details
- exports customer data
- adds an integration or AI function
- deletes information
- triggers a security alert
- breaches a platform rule
- or becomes the victim of fraud
At that point, everyone starts asking:
“Who did this?”
And often, nobody can answer confidently.
This creates practical business problems as well as GDPR concerns. If personal data is involved, organisations are expected to demonstrate accountability and maintain appropriate records of who accessed systems and when.
Shared logins weaken that evidence considerably.
They can also damage working relationships. Many disputes between clients and assistants become personal simply because nobody can clearly evidence what happened. Busy clients hit random buttons in the middle of the night and swear the VA or web designer or OBM did it!
Why 2FA alone is not enough
Two-factor authentication helps protect access to an account.
It does not solve the separate issue of identity.
If a client shares their login and forwards the 2FA code to somebody else, the platform still sees all activity as coming from the same user.
This means:
- actions are still attributed to the client
- audit trails remain unclear
- suspicious activity becomes harder to untangle
- and proving fraud or unauthorised access can become much more difficult
In practice, shared logins also create operational frustration.
The client may be driving, in meetings, travelling or simply unavailable when codes arrive. Codes expire, people resend them repeatedly, and eventually somebody suggests turning 2FA off entirely “to make things easier”.
That is where the real risk begins.
2FA is valuable protection. But when shared logins are poorly managed, businesses often end up weakening the very safeguards designed to protect them.
And log ins are shared it means everyone with the log in has the same access and rights as the client – which can be a serious problem in data privacy terms when too much data is shared with people who don’t need to see it.
The risks increase further once assistants and clients are working across AI-enabled phones, synced browsers, cloud password managers and multiple mobile devices at the same time.
Modern smartphones are no longer “just phones”. They are active processing environments in their own right.
You can read more about that here:
https://koffeeklatch.co.uk/your-phone-is-now-an-ai-processing-environment/
Busy periods make shared logins riskier
The risks increase significantly during busy periods.
This includes:
- Christmas and New Year
- summer holiday cover
- maternity or sickness cover
- conference season
- urgent launches
- team changes and onboarding
- travel periods and remote working
During these times:
- people work faster
- normal checks get skipped
- unfamiliar devices get used
- assistants cover additional tasks
- and suspicious activity can be overlooked
Scammers know this.
Many fraud attempts specifically target busy, distracted businesses through fake password resets, invoice changes, urgent payment requests and account takeover attempts.
Shared logins make these situations harder to investigate and harder to contain.
Practical ways to reduce the risks
Most small businesses can improve security dramatically without rebuilding their entire systems.
This normally means using business subscriptions (not student or personal) that provide for different users with different rights.
This does mean software subscription costs rise, and it should be part of your budget for people you are sharing personal data with.
Where possible:
- create separate user accounts
- use delegated or restricted access roles
- limit access to only what is genuinely needed
- avoid sharing master admin accounts
- keep financial control with the business owner
- share data on a strict ‘need to know basis’
- turn on alerts for important account changes
- turn on user 2FA
- keep written records of important instructions or changes
What VAs and OBMs should refuse to do
Assistants are often placed in uncomfortable situations because clients prioritise convenience over security.
There are some tasks where caution is entirely reasonable.
For example:
- changing bank payout details
- disabling 2FA
- resetting financial logins
- accessing government portals under the client’s identity
- making security changes without written confirmation
It is perfectly acceptable to say:
“I’m happy to help, but this step needs to be completed directly by you.”
Good clients usually respect clear professional boundaries when they are explained calmly.
Using contracts and data processing forms properly
Good contracts do not magically solve security problems.
What they do is create:
- clearer instructions
- better expectations
- clearer boundaries
- written records
- and a safer framework for outsourced working relationships
That matters for both the client and the assistant.
At KoffeeKlatch, our programmes and templates are designed to support the way modern online businesses actually operate, including outsourced teams, delegated access, GDPR responsibilities and AI-supported workflows.
Because in the real world, small businesses rarely operate with perfect systems. They operate with practical ones.
Where does that leave you?
Sharing logins may feel quick and convenient, but it creates problems that often only become visible after something has already gone wrong.
Most businesses do not need expensive enterprise software to improve matters. They simply need:
- clearer processes
- sensible boundaries
- better access management
- and documentation that reflects how the business actually works
If you want clearer boundaries, safer workflows and contracts that reflect how modern online businesses operate, the KoffeeKlatch programmes can help.
They include practical contract wording, data privacy support, onboarding guidance and real-world processes designed for outsourced teams, VAs, OBMs and online service businesses.
If you’d like help with the right contracts, data privacy wording, or GDPR-friendly processes for small online businesses, the KoffeeKlatch programme has you covered.
