The Account Inventory Every Shop Should Keep
Why this matters
Ask a small-shop owner to list every account the business runs on and most stop at six or seven. The real number is usually somewhere past twenty, and the ones they forget are the ones that hurt: the domain registered by a web designer who has since moved on, the card processor whose password-reset email goes to the owner's personal mailbox, the map listing a technician set up four years ago and still manages from his own phone. You cannot protect, offboard or recover an account you do not know exists. This card owns the inventory the other security cards depend on: what goes on it, the fields that matter, and why the recovery method column is the one that decides who really owns each account.
The recovery method is the real key
Every account has a front door (the password, plus multifactor if it is on) and a back door: the recovery method, meaning the email address or phone number the provider will use to let someone reset the front door. Whoever controls the recovery method can take the account, whatever the password is. A strong password on an account whose recovery email is an old, unprotected mailbox is a strong lock on a door with the key under the mat.
Recovery methods chain. Your domain registrar lets whoever holds its recovery email take the domain. Your business email lives on that domain, so whoever holds the domain can redirect your email. Your email is the recovery method for the bank portal, the processor, payroll and almost everything else. Follow any account's recovery path upward and you usually reach one or two accounts at the top: the domain and one email inbox, often the owner's personal one. Those top accounts are your real crown jewels, whatever the bank balance says.
So the inventory is not a list of passwords. It is a map of who can reset what, and its job is to show you where the chain leads somewhere you do not control. Passwords never go on it. They go in a password manager. See related: Rolling Out a Password Manager to a Small Crew.
What goes on the list
Go category by category; each one is a place the forgotten account hides.
- Domain and website: the registrar (where the domain name is registered), the DNS host if different, the website host, the site builder login. See related: Your Domain Name Is the Master Key.
- Email: the business email admin account, every user mailbox, and any personal mailbox that is a recovery method for anything below.
- Money: every bank login (operating, payroll, savings, credit card), the card processor and its payout settings, payroll service, accounting software, any lender or financing portal.
- Operations: field-service and scheduling software, phone system, the mobile carrier account for company phones (whoever controls it can move your numbers to a new SIM), the password manager itself.
- Public face: each map and search business profile, every social account, review sites, directory listings, the booking page.
- Suppliers and government: supply-house and distributor portals (they hold your payment methods and ship to addresses on file), equipment manufacturer portals for warranty registration, tax agency accounts, license board logins.
Finding the ones nobody remembers. Memory produces the first ten rows; these four sources produce the rest. Search every shop mailbox for "welcome to," "verify your email" and "confirm your account," which surfaces years of sign-ups. Read twelve months of bank and card statements for recurring charges, because every subscription is an account. Open the authenticator app on the owner's and office manager's phones and list every entry in it. Then ask each employee, techs included, what they log into for work; techs register warranty claims, order parts and post photos from accounts the office has never seen.
Then add one row for every personal account that appears in anyone's recovery column. That row is a business account now, whether or not it feels like one. See related: The Owner's Personal Accounts Are Business Accounts.
The fields, and why each one is there
| Field | What to write | Why it earns its column |
|---|---|---|
| Account | Provider and what it does | So a stranger reading it after an incident knows what it is |
| Admin or owner | The person with the top role | Exposes accounts held by someone who has left or by an outside agency |
| Other users | Everyone with a login or role | Drives offboarding; a removed employee still listed as a manager is the classic gap |
| Recovery email | The exact address | The back door; must be a shop-controlled, protected mailbox |
| Recovery phone | Whose number, not the number | Must be a phone the shop controls; a former tech's cell means he can reset it |
| MFA | Off, text, app, key | Text codes can be stolen by moving the number (a SIM swap); app or key is stronger |
| Recovery codes | Where stored, not the codes | Without them, a lost phone can mean a lost account |
| Last checked | Date | Tells you which rows are true and which are history |
The worked example is the filled-in inventory
A seven-person pool service shop sits down for an evening and builds it. The excerpt below is eight of the twenty-three rows they ended up with, with the flags they assigned. Two exclamation marks means fix this week; one means fix this month.
ACCOUNT ADMIN RECOVERS VIA MFA FLAG
-------------- -------- --------------------- ----- ----
Domain/regis. web co. designer@agency ? !!
Email admin Owner owner personal mail app
Bank, oper. Owner owner cell app
Card processor Owner owner personal mail none !!
Payroll Office office@ mailbox text !
Field software Office office@ mailbox app
Map listing ex-tech his personal mail n/a !!
Supply portal Office office@ mailbox none
Reading it row by row is the point of the exercise:
- The domain was registered by the designer who built the website, under his agency's account. The shop does not own the top of its own chain. Fixing it means getting the domain moved into an account the shop holds, which takes cooperation and some days. See related: The Agency or Web Designer Holds Your Keys.
- Email admin and the card processor both recover through the owner's personal mailbox. That mailbox is now the most valuable account the business has, and the owner discovered that night that it had no multifactor. It was added the same evening, then multifactor went onto the processor, which had none.
- Payroll uses text-message codes. Better than nothing, but payroll moves every employee's pay, so it gets an authenticator app this month.
- The map listing is managed by a technician who left two years ago, through his personal email. He has done nothing wrong; he also still controls the phone number customers see. Recovering a listing someone else manages is its own process. See related: The Business Profile Was Hijacked.
- The supply portal has no multifactor and stores a card on file. The provider may not offer it; if not, the fallback is a unique password and an alert on orders.
Four rows of eight flagged, three of them urgent. That ratio is typical of a first inventory, and the flagged rows are rarely the bank, which owners already worry about. They are the rows owners never thought of as accounts.
Ranking by what an attacker could do with it
Fix in order of blast radius, meaning what someone holding the account could do:
- Accounts that reset other accounts: domain, email admin, any mailbox that is a recovery method, the mobile carrier, the password manager. One takeover here becomes many.
- Accounts that move money: bank, processor payouts, payroll, accounting software that can send payments.
- Accounts that speak for you: map listings, social, website, booking pages. Losing them redirects customers and damages trust, but rarely moves money directly.
- Accounts that hold data or payment methods: supplier portals, field software, warranty portals.
A row in tier 1 with no multifactor and a recovery path to a mailbox you do not control outranks any amount of tidying elsewhere.
Where it lives
The inventory names who can reset your money accounts, so treat it as sensitive. Keep the working copy as a secure note in the shop's password manager, readable by the owner and one named deputy. Keep one printed copy, dated, in a sealed envelope with the recovery codes in a locked place at the shop or with the owner's documents, because during an incident you may not be able to log into anything. Do not keep it in a shared spreadsheet in the email account it describes; an attacker who takes the mailbox gets a list of what to attack next.
Keeping it true
An inventory goes stale the week after it is built. Update it at four moments: when someone is hired (add their rows), when someone leaves (remove them, and work every row they appear in; see related: The Employee Offboarding Digital Access SOP), when the shop signs up for any new service, and at the annual security review, when every row's last-checked date gets renewed by actually logging in and looking at the recovery settings rather than trusting the sheet. See related: The Annual Security Review SOP.
The test of whether it is true: pick any row and ask whether you could recover that account today, from the recovery method listed, without calling anyone. If the answer is "I'd have to ask the designer" or "he'd have to forward me the code," that row is not yours yet.
References
- See related: Your Domain Name Is the Master Key
- See related: The Owner's Personal Accounts Are Business Accounts
- See related: Turning On Multifactor Authentication Without Locking Yourself Out
- See related: The Employee Offboarding Digital Access SOP
- CISA guidance on multifactor authentication and phishing-resistant MFA for small organizations