What is the problem?
- When the person who gets the code is on leave, in a meeting or out of battery, work stops.
- The code is passed on by chat; who saw which code and when is unknown.
- When the person leaves, the line or the app has to be handed over too; it is often forgotten.
First: should the account belong to one person?
Some accounts should not be shared. On bank and government portals the user belongs to a person and sharing codes may breach the terms. Most institutions allow a separate user per employee for these accounts; that is the right way.
Marketplace and advertising panels often allow sub-users too. Where possible, give every employee their own user; if shared use is really needed, use the methods below.
Method 1: app-based codes (TOTP)
If the account supports it, choose an authenticator app instead of SMS. Scan the QR code shown during setup into the item in your shared password manager; everyone authorised can generate the same code.
Everyone who can generate the code has obtained the verification key too. That is why, when someone on the team leaves, two-step verification must be re-enrolled for those who used the code.
Method 2: a company line and SMS
If the account supports only SMS, send the code to a line owned by the company instead of a personal number. The phone holding the SIM should forward codes only for senders matching rules, and only to authorised people.
- Keep the line in a phone that stays in the office, charging and online.
- Forward only the relevant senders' messages; the line's other messages should not leave.
- Record who opened a code, and delete codes after a short time.
- Alert the person responsible if the phone goes silent.
With Passhield
TOTP codes are available today in items and in the extension. For SMS codes, channels, sender rules, the code inbox and the phone pairing wizard are ready; the Android forwarder app for the phone will be released soon.