The Spare Key You Haven't Cut: Getting Two-Factor Authentication Out of One Pocket

Most small businesses treat two-factor authentication like a good deed: switched on, vaguely reassuring and rarely looked at again. Then someone leaves, a handset goes for a swim in the canal, or the person who set it all up is on holiday with patchy signal. Suddenly the good deed becomes a very expensive locked door.

The awkward truth is that many UK businesses run critical systems through one person's phone. Email, accounting software, the domain registrar, the website hosting, maybe the bank. The security box is ticked, but the business has quietly built a single point of failure with a battery life.

This isn't about becoming a security department. It's about making sure the business can get back in when life happens.

Start with a map, not a panic

Before changing anything, list the accounts that would ruin your week if you couldn't access them. For most small firms that means:

• Business email and calendar, such as Google Workspace or Microsoft 365
• Accounting and payroll software
• The domain registrar and website hosting
• Your ecommerce platform or booking system
• Social media accounts used for customer enquiries
• Any cloud storage holding contracts, client files or staff records
• The password manager, if you use one

Next to each one, write down who set it up, which phone number or authenticator app is attached, and whether anyone else can get in. You're not looking for perfection. You're looking for the accounts where one absent phone would cause real commercial damage.

Understand what your second factor actually is

Two-factor authentication is simply a second proof that you are you. The common versions are:

• SMS codes sent to a mobile number
• Authenticator apps that generate a rolling code
• Passkeys or security keys tied to a device
• Email codes sent to a recovery address

SMS is better than nothing, but it depends on a phone number staying with the business. If that number belongs to a personal contract and the employee leaves, you may be relying on their goodwill and their mobile network's recycling timetable. Authenticator apps are generally stronger, but they live on a device. Passkeys can be excellent, but they still need a sensible recovery plan.

The practical answer is usually a mix. Use authenticator apps where you can, keep at least one backup method that isn't tied to the same phone, and make sure the business — not just the individual — controls the recovery email address.

Cut the spare key before you need it

Every account with two-factor authentication should have backup codes downloaded, printed or stored somewhere the business can reach without the primary phone. That sounds obvious until you discover the codes are in a screenshot on the phone that's missing.

A sensible approach is to store backup codes in your password manager as secure notes, and keep one printed copy in a locked drawer or safe at the office. If you're fully remote, use a sealed envelope with a trusted adviser or a secure shared vault with restricted access. What you shouldn't do is email them to yourself, leave them in a shared drive called 'Misc' or stick them under the keyboard.

While you're there, check the recovery email address on each account. If it points to a former employee's personal address, change it today. The same goes for recovery phone numbers.

Decide who holds the keys — and who doesn't

There's a difference between access and admin rights. Most staff need to use a system; very few need to change billing details, add users or alter security settings. Give admin rights sparingly and make sure at least two trusted people can get into the most critical accounts. One of those people might be the owner or a senior manager; the other might be an external IT provider or accountant with a clear agreement in place.

That isn't a security free-for-all. It's a break-glass plan. Record who has admin access, why they have it and when it was last reviewed. For a small team, a simple table in your operations manual is enough.

Build a leaving checklist that actually gets used

When someone leaves, the phone doesn't just walk out with their desk mug. It may also take the second factor for your email, payroll and website. Add these questions to your leaver process:

• Which accounts was this person an admin on?
• Which phone number or authenticator app was attached?
• Have we transferred ownership of domains, social profiles and software licences?
• Have we changed recovery email addresses and phone numbers?
• Have we removed their device from any password manager or shared vault?

If the answer to any of those is 'not sure', treat it as urgent. A calm 20-minute review now is cheaper than a Friday afternoon spent convincing a software provider that you really are the business owner.

Do the boring bits this week

You don't need a grand digital transformation project. Start with your email, accounting software and domain registrar. Check the second factor, add a backup method, update the recovery email and note who has admin rights. Then book a reminder to review it every six months, preferably before the Christmas rush rather than during it.

Two-factor authentication is a good thing. It just needs a spare key, a named owner and a plan for the day the phone doesn't come back from lunch.