Your Former Employee Still Has the Password
August 10, 2026
Your employee left three months ago. You collected the laptop, had an awkward goodbye lunch, and removed their name from the website.
Job done, right?
Maybe. Except they can still log into your CRM, Google Drive, social media accounts, payroll software, and the email address attached to your domain registration.
That’s not employee offboarding. That’s handing someone the keys to your building, watching them drive away, and assuming they’ll eventually mail them back.
Most former employees aren’t plotting revenge from a dark basement. But forgotten access still creates a serious small business cybersecurity risk. Old accounts can be compromised. Saved passwords can remain on personal devices. Shared credentials can keep working indefinitely. And one overlooked admin login can provide access to customer data, financial information, or the digital machinery keeping your business alive.
The Federal Trade Commission recommends limiting access to sensitive information and giving employees access only when they need it. NIST guidance also calls for accounts to be disabled or removed when users leave or no longer require access.
Start With an Access Inventory
Before you can remove access, you need to know what the employee could access. This is where many small businesses discover their “system” is actually a collection of sticky notes, browser bookmarks, and one person who supposedly remembers everything.
Create a list covering:
Company email and cloud storage
CRM and project management systems
Accounting, payroll, and banking platforms
Website hosting and domain registration
Social media and advertising accounts
Payment processors and e-commerce platforms
Vendor portals, phone systems, and shared drives
Physical keys, badges, cards, and company devices
Include contractors, agencies, virtual assistants, and vendors. They may not be employees, but their login credentials can still create access-management headaches long after the relationship ends.
Disable Accounts, Don’t Just Change One Password
Removing someone from company email isn’t enough. Disable their individual user accounts, revoke active sessions, remove trusted devices, and delete their recovery email or phone number.
If they used multifactor authentication, make sure the verification method is no longer tied to their device. CISA recommends MFA because it can significantly reduce the risk of account compromise, but it’s less helpful when the authentication code is still going to Kevin’s personal phone six weeks after Kevin quit.
For important platforms, check login histories and active sessions. If something looks suspicious, save the records before making further changes.
Change Every Shared Password
Shared passwords are convenient in the same way leaving your front door unlocked is convenient. Nobody has to look for a key, and eventually something terrible happens.
Change passwords for any account the departing employee used with someone else. That may include social media, Wi-Fi, vendor portals, software subscriptions, security systems, or the sacred company Canva account.
Better yet, stop sharing passwords. Give each employee their own login and use a business password manager where necessary. The FTC recommends unique passwords rather than reusing or casually sharing them across services.
Transfer Ownership, Not Just Access
An employee may have created your website analytics account, Facebook page, Google Business Profile, email marketing system, or domain under their personal email address.
Removing their day-to-day access doesn’t help if they’re still the legal or technical account owner.
Transfer ownership to a company-controlled email address. Confirm that at least two current people have administrator access to critical systems. Then check billing contacts, recovery information, API keys, connected apps, scheduled automations, and forwarded emails.
Tiny settings have a charming habit of becoming expensive emergencies.
A Quick Credit Banc Reality Check
At Credit Banc, we spend plenty of time helping business owners get their financial house in order before pursuing funding.
Clean books matter. Organized documents matter. But so does knowing who can access your bank account, accounting platform, payroll system, and financial records.
Strong internal controls don’t just protect the business from cyber risk. They make the company easier to manage, finance, and eventually sell. Nobody wants to discover during a major transaction that the former office manager still controls the QuickBooks master login.
Build Offboarding Into the Exit Process
Employee offboarding shouldn’t depend on the owner suddenly remembering six passwords at 10:47 p.m.
Create one checklist with a clear owner and deadline. Access should be removed at the employee’s departure, or immediately when required by the circumstances. Keep a record of completed steps, returned property, transferred files, and account ownership changes.
Review user access regularly, too. Employees change roles, contractors finish projects, and software accounts multiply like rabbits with corporate credit cards.
The goal isn’t to treat every departing employee like a criminal mastermind. It’s to stop treating basic business security like something you’ll deal with after a problem.
Because “we thought someone changed that password” is a lousy incident response plan.
Your Passwords Aren’t the Only Thing That Need a Checkup
Cleaning up employee access protects the business you’ve already built. Making sure you have the right funding in place can help protect where it goes next.
Credit Banc helps business owners compare funding options across more than 150 lenders without filling out the same damn application over and over again.
One request. Multiple options. A structure that actually makes sense for your business.