The Login Nobody Can Find: What Happens When the Person Who Set Up Your Marketing Leaves

It usually surfaces on a Tuesday.

A business wants to pause an ad campaign, or update the trading hours that show up on Google, or change the phone number on the website. Someone goes looking for the login and finds that the account was created by a contractor who stopped returning calls eighteen months ago, under an email address at a domain that no longer exists.

This is one of the most common and least discussed problems in small business marketing. The work gets done, it works well enough, and then the person who did it moves on and takes the keys with them.

How it happens

Almost nobody sets out to lock a business out of its own accounts. It happens because setup is usually done in a hurry by whoever is available.

A web developer registers the domain on their own registrar account because it is faster than walking the client through it. A marketing contractor creates the Google Ads account under their personal Gmail because they are already logged in. A staff member claims the Google Business Profile with their work email, then leaves, and the email address gets deleted.

Each of those decisions is reasonable in the moment. Collectively they produce a business whose entire online presence sits under logins it does not control.

The fix is not complicated, but it is much easier done at the start. Every account should be created under an address the business owns, such as admin or marketing at the business domain, with everyone else granted access to it. The tech digital marketing runs on belongs on the business's own books in the same way a lease or a vehicle registration does, rather than living in someone's personal account.

The five worth checking this week

The domain name. This is the most important one and the most commonly misfiled. Whoever controls the domain controls both the website and the business email. Check who is listed as the registrant, and check which registrar account it sits in, because those can be two different things. If the registrant is a former web developer's company rather than yours, sort that out before anything else.

Hosting and the website itself. Separate from the domain. Find out where the site is hosted, who pays for it, and whether you have an administrator login to the content management system. A surprising number of businesses have never seen the back end of their own website.

Google Business Profile. The listing that shows your hours, phone number and reviews in search and maps. It has a single primary owner and a set of managers. If the primary owner is a person who no longer works with you, changing anything becomes a request rather than a task.

Advertising and analytics. Google Ads and Meta ad accounts, plus Google Analytics. The critical point here is that ad accounts and Facebook Pages should sit inside a business manager account owned by the business, with the agency added as a partner. Agencies running client assets inside their own business manager is common and it makes leaving expensive.

Your email list and customer data. Whichever platform holds it, confirm you can log in and export the list. A customer list you cannot export is a customer list you are renting.

Access is not the same as ownership

There is a distinction worth understanding, because it is where most handovers go wrong.

Most platforms have tiers. Someone can be an owner, an administrator, or a user with limited permissions. Owners can remove administrators. Administrators generally cannot remove owners. If your agency holds the owner role and you hold administrator, you do not actually control the account, regardless of what the invoice says.

Related to that: sharing a single login is not access management. Passing one username and password between staff and contractors means you cannot see who changed what, you cannot remove one person's access without changing the password for everyone, and you cannot use two factor authentication properly.

Every major platform supports adding people individually with their own logins and defined permission levels. Use that. Remove people when they leave. It takes a minute and it saves the Tuesday morning scramble.

Getting it back

If you are already locked out, recovery is possible but slower than it should be.

Google has a process for requesting access to a Business Profile that someone else has claimed. You submit a request, the current owner is notified and given a window to respond, and if nobody responds you can generally be granted access. It takes days rather than minutes, so do not start it the week of a rebrand.

Domains can be transferred between registrars, and the registrant details can be updated, though this normally needs cooperation or evidence of the business's entitlement to the name. Australian domains have their own eligibility requirements tied to the registrant, which is worth understanding before you begin.

Ad platforms vary. Google Ads support can help in some circumstances. Meta assets are harder, and if a Page sits in someone else's business manager without any admin on your side, expect a long process.

The pattern is consistent. Recovery is possible, it is just far more expensive in time than prevention would have been.

Doing it properly the second time

If you are rebuilding anyway, a few habits make the next handover uneventful.

Create a business owned email address that is not tied to any individual, and use it as the root account for everything. Put two factor authentication on it, with recovery options that more than one person in the business can reach. Keep a simple document listing every platform, what it does, who the owner is and who has access. Review it whenever someone joins or leaves.

Then grant contractors and agencies their own access at the level they need, and remove it when the engagement ends. A good agency will expect this and will often suggest it unprompted. Anyone who resists holding the arrangement this way is telling you something worth hearing.

The unglamorous part

None of this improves a campaign or wins a customer. It is administrative housekeeping, and it competes for attention with everything else a small business has to do.

It is also the difference between changing your own trading hours in thirty seconds and spending three weeks trying to prove you own your own name.