It starts innocently. A new hire needs access on day one and their account isn't ready, so a colleague says "just use mine". Six months later, four people know that password, it is written on a sticky note, and nobody is entirely sure who approved last Tuesday's payment. This is not a people problem — it is a very ordinary shortcut with expensive consequences.
What you lose the moment a login is shared
- The audit trail. Every system records who did what. With a shared ID, "who" is meaningless. If a file is deleted, a payment is changed or a record is accessed, you cannot tell whether it was Priya, Marc, or someone who stole the password. Regulators, auditors and insurers all ask this question; "we're not sure" is a bad answer.
- Multi-factor authentication. MFA assumes one person owns one phone. Shared accounts either break it or get exempted from it — and an exempted account is exactly what an attacker looks for.
- The ability to say goodbye cleanly. When someone leaves, you disable their account. If their password was shared, you have to change it everywhere and tell everyone — or, more often, nobody does.
- Licensing compliance. Most software is licensed per named user. Sharing an account to save a licence is a breach of the agreement, and vendors do audit.
The better way costs about ten minutes
Individual accounts for everyone, created before day one. Permissions granted by role — "front desk", "finance", "technician" — rather than copied from a colleague. Shared mailboxes for shared jobs, which are free and give everyone their own login to the same inbox. And a leaver process that turns off one account and revokes everything with it.
Where we come in
Joiners, movers and leavers are the most routine requests we handle, and we handle them the same day. Nobody at a Spicsoft-managed business should ever need to borrow a login, because the right one is always there when they start — and the audit trail behind it is intact if anyone ever needs to ask what happened.
