The Owner's Personal Accounts Are Business Accounts

Why this matters

In most small shops, the business's most important accounts do not really belong to the business. The domain was registered with the owner's personal email. The payment processor sends its codes to the owner's personal mobile. The business social page is administered through the owner's personal profile. So the shop's security is only as good as the owner's personal email password, the owner's phone carrier's front desk, and whoever else in the owner's household is signed in to the family tablet. An attacker after the business does not need to break into the business. They need to break into the owner, and the owner's personal accounts are usually protected the way personal accounts are: lightly.

How the business ends up hanging off one person

Nobody designs this. It accretes. The owner opened the first accounts before there was a business email, using the address they already had. Later accounts asked for a mobile number for "security," and the owner gave theirs. When a vendor needed a "recovery email," the personal address was the one the owner could remember. Ten years in, the shop has dozens of accounts and the owner has never written down which of them can be reset from a personal inbox.

The accounts fall into three groups, and they need different treatment:

• Accounts registered to a personal identity by necessity. Some social platforms only let a business page be run through a personal profile. You cannot fix the dependency; you can only add a second administrator and protect the personal profile like a business system.
• Accounts registered to a personal identity by habit. The domain registrar, the processor, the bank's alert contact, the accounting software, the supplier portals. These can and should be moved to a business-controlled address.
• Accounts that are genuinely personal but hold business keys. The owner's personal password manager, browser sync, and phone photo backup. These do not move; they get secured, and the business keys inside them get copied somewhere the business controls.

The full list of business accounts is a sibling's job. See related: The Account Inventory Every Shop Should Keep. This article is about the column on that list most shops leave blank: what each account recovers to.

The chain: which account resets which

The reason this matters more than any single password is that accounts reset each other. Follow a typical owner's chain:

 owner's mobile number
    | texts reset codes to
    v
 owner's personal email ---- recovery for --> registrar
    |                                           |
    | password resets for                       | controls
    v                                           v
 processor, bank alerts,                   shop domain
 accounting, social admin                       |
                                                | runs
                                                v
                                     staff email, website

Two things fall out of that picture. The top two boxes are the real keys. Whoever controls the mobile number can usually take the personal email, and whoever controls the personal email can reset nearly everything else, including the registrar, and through it the domain that every staff mailbox runs on. And neither of the top two boxes is protected by anything the shop runs: one is protected by a carrier's customer service process, the other by the owner's personal habits. See related: Your Domain Name Is the Master Key.

The phone number is the weakest link

A SIM swap is when an attacker persuades the mobile carrier to move your number to a SIM card they hold, usually by calling or visiting a store pretending to be you, armed with details from a data breach. A port-out is the same move to a different carrier. Either way, your phone goes to "no service," and every text-message code sent to your number arrives on theirs. Combined with a reused password, it is the standard way into accounts protected only by text codes.

Three defenses, in order of value:

1. A port-out PIN or number lock with your carrier. Most carriers offer a separate PIN that must be given before the number can be moved, and some offer a lock that blocks transfers entirely until you lift it. The FCC adopted rules in 2023 requiring wireless carriers to use stronger customer authentication before a SIM change or port-out and to notify the customer when one is requested; how each carrier implements that varies, so as of 2026 ask yours directly what protection it offers and switch on the strongest one.
2. Move important accounts off text codes. An authenticator app on the phone, or a hardware security key, cannot be redirected by a SIM swap. Text codes are better than nothing and much worse than either. See related: Turning On Multifactor Authentication Without Locking Yourself Out.
3. Treat "no service" as an alarm. If your phone suddenly loses service in a place it normally works, call the carrier from another phone right away and ask whether a SIM change or port was made on the account.

The personal email, run like a business system

The owner's personal email is, functionally, the shop's master recovery account. Give it the protection that role deserves:

• A second factor that is not a text message: an authenticator app, a security key, or a passkey (a sign-in credential stored on your device that replaces the password and cannot be phished in the usual way).
• A recovery review. Open the account's security settings and read every recovery phone number and recovery email. Old numbers from a previous phone plan and an ex-spouse's address are common finds, and each one is a door.
• A forwarding and filter check. Attackers who get in often set a rule that forwards or hides messages containing words like "bank," "payout" or "password." Look at the forwarding settings and the filter list. See related: Payouts Stopped Arriving in the Bank, which turned on exactly such a rule.
• A connected-apps check. Remove access for apps and services you no longer use; each can read or send mail as you.
• Nobody else signed in. A family tablet signed in to the owner's personal account gives every person using that tablet the keys to the business.

Worked example: one owner's recovery audit

The owner of a sixteen-person plumbing shop sat down with the office manager for an afternoon and listed eleven business accounts that would hurt most if someone else held them, with one new column: what each one recovers to.

What the column showed. Seven of eleven recovered to the owner's personal email (registrar, business email admin, processor, accounting, social, review profile, supply house). Nine of eleven sent codes by text to the owner's mobile. Only one used an authenticator app. And the business email admin recovered to the personal address, which meant the personal inbox could take over every staff mailbox in the shop.

The owner's personal email itself had a recovery phone number from a plan cancelled four years earlier, and no second factor. That single account sat above the other seven, so it was fixed first: authenticator app on, the dead number removed, a forwarding check (clean), and a port-out PIN set with the carrier the same day.

The moves, in the order they were done. The registrar and business email admin were next, because between them they control the domain: each was moved to a dedicated business admin address that is not anyone's day-to-day inbox, with an authenticator app and a second admin, the office manager. Then the processor and accounting software, moved to the same admin address and switched to the authenticator app. The social page got the office manager added as a second administrator, since the platform requires a personal profile behind it; the owner's personal profile got an authenticator app. The review profile and the supply house portal were moved to the admin address too; the review profile took an authenticator app, and the supply house portal, which offered no second factor at all, got a unique password from the shop's password manager and a note to ask the supplier about it.

By the end, the count read: one of eleven still recovering to the personal email (the social page, unavoidably, through the personal profile), and three of eleven still on text codes (the bank, payroll and equipment financing, none of which offered an app option on the shop's account tier at the time), against seven and nine before. The afternoon took about four hours, most of it waiting on verification emails.

What would have changed the order. A shop whose owner had just seen a "no service" episode on their phone should start with the carrier, not the email, because an active SIM swap makes every text code already compromised. And a shop with two co-owners should not consolidate everything to one person's control in the name of tidiness; each critical account should have both as administrators.

The account that outlives the owner

There is a quieter version of this risk that has nothing to do with attackers. If the owner is hospitalized or dies, every account recovering to their personal email and phone is locked to everyone else, including the family member or partner who now has to run payroll next Friday. The platforms will not simply hand access to a relative. Many states have adopted a version of the Revised Uniform Fiduciary Access to Digital Assets Act, which governs when an executor or other fiduciary can reach a person's online accounts, and it generally honors the person's own written directions and the platform's settings. The fix is operational before it is legal: a second administrator on every critical account, and the master recovery details written down in a sealed envelope or a password manager's emergency access feature. Whether your will or business documents need language about digital accounts is a question for your estate attorney. This is not legal advice.

How to tell you have untangled it

Pick the account that would hurt most, usually the registrar or the processor, and ask: if the owner's personal phone and personal email were both in a stranger's hands tonight, could that stranger take this account? If the honest answer is no, because it recovers to a business admin address protected by an app or key and has a second administrator, that account is done. Work down the list until the answer is no everywhere you can make it no, and protected-as-well-as-possible everywhere you cannot.

References

• FCC Report and Order on SIM swap and port-out fraud (2023), for carrier authentication and notification duties
• Revised Uniform Fiduciary Access to Digital Assets Act (Uniform Law Commission), as adopted by your state
• See related: The Account Inventory Every Shop Should Keep
• See related: Your Domain Name Is the Master Key
• See related: Turning On Multifactor Authentication Without Locking Yourself Out