Held in Another's Name: Auditing and Reclaiming the Accounts Your Business Doesn't Actually Control

There is a particular kind of operational risk that never appears on a risk register because nobody knows it exists. It surfaces at the worst possible moment: the day a supplier stops replying, the morning a password reset goes to an inbox that no longer exists, the afternoon a departing contractor decides the relationship has ended.

The risk is simple to describe. A system your business depends on is registered in someone else's name. The account exists, it works, and it is not yours.

Why this happens so often

Almost never through negligence. Small firms move quickly, and the fastest route to a working setup is usually the person nearest the task. A web designer registers the domain because the project starts on a Friday. A marketing freelancer opens the advertising account because they already have one. A founder uses a personal Gmail address for the company's cloud storage because it was the only login to hand at the time.

Each decision is reasonable in isolation. Collectively they produce a business whose digital estate is held in a patchwork of personal identities, with ownership resting on goodwill and memory rather than documentation.

The consequences are rarely dramatic at first. They are administrative, then financial, then occasionally existential — a lapsed renewal, an unresponsive administrator, a domain that cannot be recovered without correspondence the business no longer holds.

What is actually at stake

Not all accounts carry equal weight. Four categories deserve immediate attention.

Identity infrastructure. Domains, DNS records, and the email tenancy behind them. Lose control of the registrar account and you lose the ability to redirect mail, renew certificates, or prove to anyone that the domain is yours.

Data-bearing storage. Cloud drives, backup platforms, and collaboration workspaces holding client records or personal data. If the account holder is an individual rather than the business, the organisation's ability to answer a subject access request or demonstrate accountability under UK data protection rules becomes contingent on a third party's cooperation.

Money-moving dashboards. Payment processors, invoicing platforms, and bank-linked tools. Ownership here is often indistinguishable from the ability to receive funds, which makes it a control issue rather than a convenience one.

Public-facing properties. Social profiles, listing pages, app store entries, and review accounts. These are difficult to recover and, once lost, can be used to misrepresent the business to its own customers.

Building the register

Begin with a single spreadsheet and a rule: every row represents one account, and every row must name both the account and the identity it is registered to.

Useful columns are unglamorous. Service name. Purpose. The email address on the account. The legal entity or individual named as owner. Billing method. Renewal date. Who holds administrative access. Whether two-factor authentication is enabled and where the recovery codes sit.

Populate it from the places where truth tends to accumulate: finance records for anything with a recurring charge, the browser's saved-password store on company devices, invoices filed over the past two years, and the memory of whoever handles IT. Where the register cannot be completed, that gap is itself a finding.

Expect the exercise to take longer than anticipated. The value is not the document — it is the discovery that three domains are registered to an address at a dissolved company.

Triaging what you find

Sort findings into three tiers.

Tier one covers anything that could halt trading: the primary domain, the email tenancy, payment processing, and the accounting system. These should be resolved within days, not months.

Tier two covers systems that would cause disruption but not cessation — marketing platforms, analytics, hosting, and the tools that sit behind customer support.

Tier three covers dormant or low-value accounts, which are often best closed rather than transferred.

The recovery sequence

For most services, recovery follows a similar path, and the sequence matters.

First, confirm what the provider's own process requires. Nearly every platform has a documented ownership-transfer or account-recovery route, and nearly all of them ask for evidence that the business, not the individual, is the rightful holder. Acceptable evidence typically includes a paid invoice bearing the company name, incorporation details, correspondence from a company email address, and proof of the billing relationship.

Second, secure the email address on the account before attempting anything else. If the recovery inbox is a personal address, request a change of email through the platform's support channel and be prepared to supply documentation. Do not attempt a password reset to an inbox you do not control; that simply alerts the holder.

Third, if the individual is contactable, ask them to add a business-owned administrator rather than relinquish the account outright. A cooperative handover is quicker, cheaper, and leaves a cleaner audit trail than a dispute. Put the request in writing and confirm completion in writing.

Fourth, where the individual is unresponsive, escalate through the provider's formal complaints or dispute process. For .co.uk domains, Nominet publishes a dispute resolution procedure; for .com registrations, the registrar's transfer and ownership dispute route applies. These processes are slow but well-documented, and they reward businesses that can produce contemporaneous records.

Fifth, only after control is restored, rotate credentials, enable two-factor authentication under company control, and record the change in the register.

Prevention, written down

Recovery is expensive. A short ownership policy, adopted before the next hire, is not.

Five clauses do most of the work. Business-critical accounts must be registered to a company-controlled email address on a company-owned domain, never to a personal one. Administrative rights should be granted as a role that can be revoked, not as ownership that must be negotiated. Where an external party must hold access, they receive a named account, and the business retains a second administrator. Every engagement ends with a documented handover checklist. And the register is reviewed annually, ideally alongside insurance renewal, when someone is already thinking about what could go wrong.

None of this is exotic. It is the same discipline applied to keys, alarm codes, and bank mandates. The only difference is that digital accounts fail quietly, and quiet failures are the ones that catch firms out.

This article offers general guidance rather than legal advice. Where an account is disputed, or where personal data may be affected, take advice from a solicitor or data protection specialist.