Are Employees Unknowingly Sharing Your Company’s Access Details?

An employee sends a password through WhatsApp to help a colleague. Someone approves a login notification they did not request. Another staff member gives a remote access code to a caller claiming to be IT support.

These actions may seem harmless, especially during a busy working day. However, they can give someone unintended access to company email, files or business systems.

What Counts as Access Details?

Access details include more than passwords. They can include:

• Email, accounting system and administrator credentials.
• One-time passwords (OTPs) and recovery codes.
• Remote support session codes and unattended access passwords.
• VPN login details.
• File-sharing links that allow access without signing in.

Approving an unexpected multi-factor authentication (MFA) request can also grant access, even if no password is shared.

How Do Employees Accidentally Expose Access?

Sharing Passwords Through Messages

Sending a password through email, WhatsApp or a group chat creates another copy of that information.

It may remain available on personal devices, linked computers or old conversations long after the original task is complete. Group membership may also change without anyone reviewing previously shared credentials.

Trusting an Unexpected Support Request

A caller may claim to be from your IT provider and ask an employee to install remote access software, share a session code or approve a connection.

Remote support tools have legitimate uses. The risk arises when employees grant access without confirming who is requesting it and why.

Entering Credentials on a Fake Login Page

A message about an expired password or shared document may lead to a convincing imitation of a company login page.

Entering a password—and sometimes an OTP—can allow an attacker to attempt access to the real account.

Approving Unexpected MFA Notifications

Repeated login prompts can confuse or frustrate employees. They may approve one simply to make the notifications stop.

An approval request that the employee did not initiate should be rejected and reported.

Creating Overly Broad Sharing Links

An employee may choose an “anyone with the link” option when sharing a document.

If that link is forwarded, people outside the intended audience may gain access. The correct sharing setting depends on the sensitivity of the information and who needs it.

How Can Your Business Reduce the Risk?

Give Employees Individual Accounts

Where supported, provide each employee with their own account and the permissions required for their role.

Individual accounts make it easier to review access and remove it when someone changes roles or leaves the company.

Provide a Safe Way to Share Necessary Credentials

Where shared credentials are unavoidable, use an approved business password manager with controlled sharing.

Avoid keeping company passwords in ordinary spreadsheets, chat groups or unprotected notes. Review who can access shared credentials regularly.

Establish a Remote Support Verification Process

Employees should know who provides IT support and how to verify a request.

For an unexpected call or message, contact the provider through a number already held in company records. Confirm the support request before granting access.

Employees should enter passwords themselves where possible and avoid disclosing OTPs or recovery codes.

Train Staff to Check Before Approving

Teach employees to pause before entering credentials, approving a sign-in or sharing a file.

Use known application links or bookmarks for important systems. Where supported, adopt phishing-resistant authentication such as passkeys or security keys.

Review Permissions and Sharing Settings

Limit access according to job responsibilities. Use named recipients for sensitive documents and apply link expiry where appropriate and available.

Remove unnecessary access when projects end or employees leave.

What If Access Details Have Already Been Shared?

Report the incident to IT immediately, even if no suspicious activity is visible.

Depending on what was exposed, IT may need to change credentials, revoke active sessions, remove sharing links, disable remote access or investigate account activity.

Changing a password alone may not remove an existing session or cancel another form of access.

Make Reporting Easy

Employees should feel comfortable reporting an accidental disclosure quickly. Delayed reporting can give an unauthorised person more time to use the access.

Contact MY IT PLT to discuss company account security, remote access controls and practical IT support for your business.