The most common way a small business loses its social accounts is not hacking. It is that the login was shared with someone, that person left, and nobody changed anything until it mattered.
Why sharing a password is worse than it looks
- Two-factor codes go to one phone, so either the security is off or one person is the bottleneck
- There is no record of who did what, which matters most on the day something goes wrong
- Removing access means changing the password for everyone, including the people you are keeping
- A platform can lock an account it sees being used from four cities in a day
What to do instead
Every network that matters has real roles. They are not hidden, they are just in a settings screen nobody visits.
- Facebook and Instagram — add people through Business Manager, with a role, per asset. This is also what lets a scheduler publish without ever seeing a password.
- TikTok — accounts can be assigned to a business account with member roles.
- Telegram — add the person as a channel administrator, with only the permissions they need.
The scheduler is a third kind of access
Connecting an account to a tool grants that tool a token, not your password, and the token can be revoked from the platform at any time without touching your login. That is the point of doing it that way.
Worth doing once a year, in ten minutes: open the connected-apps list on each network and remove what you no longer use. Old tokens are the quiet part of most access problems.
When someone leaves
Remove the role, revoke the tool, and check the connected-apps list. If a password was ever shared, change it — and take the opportunity to stop sharing it.