Guide · Access · Business

After a staff exit: lock access in one afternoon

Someone resigns, or you let them go. The laptop is still on the desk. Their email still works. So does the bank login they “just help with,” and the WhatsApp group where suppliers send invoices.

That gap is when diverted payments and quiet data copies happen. You do not need an IT department to close it. You need one afternoon and a list.

Do this before they walk out

Work from a device and account you control — not theirs.

1. Email. Reset the password. Sign out other sessions. Remove them as an admin. Check for forwarding rules and “send as” aliases.
2. Files. Remove them from shared drives, client folders, and any personal link that was set to “anyone with the link.”
3. Money. Remove them from online banking, card apps, and accounting tools. If they were a signatory, call the bank the same day — software removal is not the same as a bank mandate.
4. Chat. Remove them from supplier and finance groups. Change group admins. A stolen chat thread is how fake bank details keep arriving.
5. Keys and codes. Building access, shared passwords, password-manager vaults, and recovery phone numbers.

Write down what you changed and when. If something goes wrong later, that note is the start of a timeline.

What people skip

• The mailbox of a role (accounts@, info@) that several people used, including the person who left
• A laptop taken home “to finish the handover”
• Supplier WhatsApp chats that still show their name as admin
• Cloud billing (domains, ads, software) tied to their card or login

If you cannot see who still has access, assume too many people do.

If you already suspect misuse

Do not wipe the laptop to “start fresh.” Save emails and screenshots first. Change passwords from a device you trust. If money moved, call the bank the same day.

Then get a calm review of what happened — not a promise that funds come back. Our confidential assessment is for that file, not for hacking accounts or giving legal advice.

A 30-minute habit after every exit

Keep a one-page access list: email, bank, accounting, chat, domain, and who the backup admin is. Update it the day someone joins or leaves. The list is boring. It is also what stops a bad week becoming a missing payment.