When the verification code goes to one phone

You want to sign in to a marketplace panel; the whole team has the password, but the verification code goes to Ayşe's phone. Ayşe is in a meeting, on leave or no longer with the company. This is so common in small teams that it is rarely seen as a problem, yet it is a real risk for both continuity and security.

Why it matters

• Work stops. Nobody signs in until the code arrives. If the person cannot be reached, neither can the panel.
• Codes end up in chat groups. "Can you send me the code?" moves verification codes into chats as screenshots.
• You get locked out when they leave. When the person leaves, the account's second step leaves with them. Recovering the account can take days.
• You cannot tell who signed in. Once a code is shared, who actually signed in becomes unclear.

Two kinds of code, two answers

App-based codes (TOTP)

These are the six-digit codes from apps like Google Authenticator. The QR code shown at set-up is really a key, and the codes are derived from it. So the answer is simple: scan the QR code not into one phone but into a secure place the team can reach.

In Passhield you scan the QR code into the account's item and the code is generated inside it. Every team member with access to the vault can see the code, the extension fills it on the sign-in page, and who took the code is recorded.

Codes by SMS

Some services send codes only by SMS. Two steps are advised:

1. Move the account's phone number from a personal phone to a company line.
2. Decide which team members see the codes that arrive on that line.

In Passhield, SMS codes are designed to appear channel by channel, only to team members with permission on that channel. The forwarder app for the Android phone holding the company SIM is coming soon.

Bank and government accounts

On corporate banking and government systems, users are personal; sharing a verification code may breach your agreement. The right way is a separate user for each employee.

For more detail see our guide to verification codes on shared accounts and the code inbox page.

In short

A verification code should belong to the team, not to one person. For app-based codes, scan the QR code into a shared, encrypted vault; for SMS codes, move the number to a company line and decide who can see the codes.