Brand Accounts That Survive Staff Turnover
Contents
- The short version
- The four things that actually break
- Who owns what, in writing
- Why does SMS recovery make staff turnover worse?
- Which setup survives a departure?
- How do you set up a brand account step by step?
- What changes per platform and per country?
- What do you do if the number already left with the employee?
- Common questions about brand accounts and phone numbers
The account still works. The problem shows up the first time it asks for a code, because the code goes to a personal phone that walked out with a former employee. Password managers do not help. The SMS goes where the carrier sends it, and the carrier does not know about your handover checklist.
Where brand accounts go wrong
| Setup | What happens when the person leaves |
|---|---|
| Verified on a personal phone, SMS recovery | The account leaves with them |
| Personal email as recovery | Reset codes go to an inbox you cannot read |
| One person holds the authenticator | Nobody else can approve a login |
| Passwords in chat | The next hire cannot find them |
Most brand accounts are set up in a hurry by whoever had a phone in their pocket that day. The table below shows the four common setups and what each one costs you at the exit interview.
The fix runs in one direction: move sign-up, recovery and 2FA onto assets the company holds, before the person leaves. A handover that only transfers a password is a handover of about 40 percent of the account.
The short version
Sign-up phone, recovery email, recovery phone and 2FA method are four separate fields on most platforms. A departure breaks whichever ones point at a person. Audit all four, replace the personal ones with company-held ones, then confirm a live login from a second device.
The four things that actually break
- Sign-up number. Used for re-verification after a suspicious login or a device change.
- Recovery phone. Often left blank, then silently filled with a personal number during a security prompt.
- 2FA method. SMS to a personal phone, or an authenticator app on a phone you never see again.
- Recovery email. A personal address, or a work address that gets deactivated on day one.
Who owns what, in writing
Keep a one-page record per account: platform, handle, sign-up number, recovery email, 2FA method, current owner, and the date each field was last checked. Without it, nobody knows which accounts are exposed until one locks.
For sign-up and re-verification on company terms, a rented number from MarioSMS starts at $0.04 and delivers the code to your dashboard in about a minute, with the activation refunded if no SMS arrives.
Why does SMS recovery make staff turnover worse?
The number is a recovery key, not just a sign-up step
The number entered at sign-up does not retire after the first code. It stays on file as the channel the platform trusts when something looks wrong. Password resets, new-device logins, appeal forms and “confirm it’s you” prompts all route back to it. Two or three years later, that number still opens the account, and it lives in the pocket of someone who no longer works for you.
Re-verification requests arrive at the worst time
Platforms trigger re-verification on events, not on a schedule. A login from a new country, an agency added to the account, a sudden jump in posting volume, a reported piece of content. Those are the moments when you need access fastest. The prompt gives you a short window, often a few minutes, and the OTP goes to the number on file, not to the person at the keyboard.
Recycled numbers and reassigned SIMs
Carriers return disconnected numbers to the pool and reissue them. A former employee’s personal line can end up with a stranger who receives your recovery codes, or go dead and leave the account with no working channel. Company SIMs get reassigned inside the business too, which moves the recovery key to a department that has no idea what it controls.
Where an authenticator app sits in the chain
An authenticator code proves possession of a seed on one device. It does not replace the phone number, because most platforms keep SMS as the fallback when the seed is lost. If the app was set up on a personal handset that left the building, the seed leaves with it. Store the recovery codes from 2FA setup in the same shared vault as the password, generated once and checked the day the account is created.
Which setup survives a departure?
The target configuration has four pieces, and none of them sit on a personal device. A sign-up number the company controls, a recovery email on the company domain, authenticator seeds copied into a shared vault, and a written record of who owns what. The table below lists each piece and its owner.
A setup that survives
| Piece | Owned by |
|---|---|
| Sign-up number | A rented number, or a line the company pays for |
| Recovery email | A shared mailbox on the company domain |
| Second factor | An authenticator in a shared password vault |
| Recovery codes | Printed or in the vault, not on a phone |
A company-held SIM versus a rented number
A company SIM on a desk phone works if someone answers it and pays the bill. A rented number from MarioSMS handles the sign-up and the activation itself, with the code visible in the dashboard rather than on a handset. No contract, no monthly line, no leaver taking it home.
Recovery email on the company domain
Use brand-social@yourcompany.com, owned by the admin who controls the mail tenant. When the employee leaves, you suspend their user and the brand address keeps receiving. Personal Gmail addresses on a brand Instagram or TikTok account are the single most common failure, as shown in the screenshot.
Authenticator seeds in a shared vault
When a platform shows the QR code during 2FA setup, it also shows a text secret. Save that secret and the backup codes in the team vault, then enroll two devices from the same seed. Cost is whatever your password manager already charges per seat, usually a few dollars a month.
What the sign-up number costs
| Piece | Owned by |
|---|---|
| Sign-up number | Company (SIM or rented) |
| Recovery email | Company domain admin |
| Password and 2FA seed | Shared vault, two admins |
| Ownership record | Documented, reviewed quarterly |
Numbers start at $0.04 and vary by service and country, so a five-account brand setup can cost under a dollar. Each activation has a timer, and if no SMS arrives the charge returns to your balance automatically. Stock covers 35+ countries and hundreds of services, checked live before you start.
The rented number handles verification once. Long-term control comes from the vault and the domain, and the recovery email matters more than either.
How do you set up a brand account step by step?
Steps 1 to 8: creating the account
- Create the shared mailbox first, on a domain you own (support@, social@). Never a personal address.
- Put the mailbox password and recovery codes in the company password vault, shared with the owner group, not a single seat.
- Rent a number from MarioSMS for the platform and country you need. Prices start at $0.04, and stock covers 35+ countries.
- Start the signup, request the code, and read it in the app or dashboard, usually within a minute. If nothing arrives before the timer ends, the activation cancels and the price returns to your balance.
- Set two-factor authentication to an authenticator app, not SMS, and store the seed in the vault next to the password.
- Download the backup codes into the same vault entry.
- Add staff through the platform’s business or team layer (Business Manager, team roles) so their personal logins never hold the master credential.
- Log the record in the account register.
The handover checklist when someone leaves
- Remove the person’s role in the business or team layer, same day.
- Rotate the shared mailbox password in the vault.
- Regenerate the authenticator seed and the backup codes, then re-scan on a device the company holds.
- Revoke active sessions and connected apps on the platform.
- Check the mailbox for forwarding rules or filters the person added.
- Confirm the recovery phone field points to nothing personal. Remove it or replace it.
- Have a second person sign off on the register entry.
What to record in the account register
| Field | Example |
|---|---|
| Platform and handle | Instagram, @brandname |
| Recovery email | social@yourdomain.com |
| Vault entry ID | VAULT-0142 |
| 2FA method | Authenticator app, seed in vault |
| Created on | 2026-03-04 |
| Last rotation | 2026-08-19 |
| Owner role holders | Two named staff |
Run the register as a single spreadsheet or vault note, reviewed every quarter. Ten accounts take about 20 minutes to check.
What the sign-up number costs
| Service | Cheapest country | Price | Numbers in stock |
|---|---|---|---|
| Sweden | $0.06 | 361,963 | |
| TikTok | United Kingdom | $0.05 | 3,070,954 |
| Telegram | Canada | $0.51 | 4,466,186 |
| United Kingdom | $0.06 | 1,972,023 | |
| United Kingdom | $0.02 | 3,734,941 |
Source: MarioSMS catalog, 2026-09-12.
What changes per platform and per country?
The setup that survives turnover depends on whether the platform separates the account from the person. Some do. Some treat the login as the whole identity.
Platforms with real role systems
Meta’s Business Manager, Google’s brand accounts and LinkedIn Pages all let you invite people to an existing asset. The page or property sits in a container, and staff attach to it with named roles. When someone leaves, you remove the seat and the asset stays. Keep at least two admins so a single departure cannot orphan the container.
TikTok Business Center works the same way for ad accounts, though the organic TikTok profile still logs in with one credential set.
Platforms where the login is the account
Instagram, Telegram and most consumer apps have no seat layer for the primary profile. One phone number, one email, one password. Anyone with those three has full control. Re-verification differs too: some apps ask for an SMS code only on a new device, others re-check every 30 to 90 days or after a password reset. Assume any consumer app can ask for the number again at any point, and store the recovery path in the vault rather than on someone’s phone.
Country availability and stock
Number stock is not uniform. MarioSMS lists 35+ countries and hundreds of services, with prices from $0.04 that move with both. A popular service in a high-demand country costs more than the same service on a quieter route. If a specific pair is out of stock, a nearby country often works.
Local presence and language prompts
Some platforms serve prompts in the language tied to the number’s country code, and some ad tools ask for a local contact number before approving a business profile. Pick the country that matches where the brand actually sells, not the cheapest row.
What do you do if the number already left with the employee?
Triage in the first 48 hours
- List every account the person verified, including ad tools and sub-accounts.
- For each one, check whether a working session survives on a company device. Do not log out of it.
- Rank accounts by audience size and revenue, not by how annoying they are to fix.
- Change the recovery phone and email on the top-ranked account first.
If you still have login access
An active session is your whole window. Open security settings, replace the departed number with a company-controlled one from a rented number, then add an authenticator app and download backup codes. Move the recovery email to a shared inbox before you touch anything cosmetic. Confirm the change stuck by logging in from a second device.
If you have lost login access
Open the platform’s business support or account recovery form and prepare proof of ownership: incorporation documents, domain records, invoices for ad spend, older content files. Expect days, not minutes. Ask the former employee in writing for one code, with a clear scope and a witness on the thread. Some people help; plan as if nobody does. More detail in account recovery without the number.
Rebuilding a channel without losing the audience
Announce the new handle from every channel you still control: website, email list, other platforms, packaging. Post the same content to both handles for two weeks if the old one is still visible. Keep the name close to the original, with one suffix, so search still lands.
What not to try
Do not buy recovery services, create fake documents, or impersonate the person who verified the account. Our acceptable use rules cover this.
Common questions about brand accounts and phone numbers
Can two people share one brand account login?
Yes, through a password manager with a shared vault and a 2FA seed both can generate. Never share the login by message. Two named people with access is the minimum that survives one resignation.
Should the owner’s personal number be the backup?
No. Owners change roles, change carriers and lose phones. Use a number the company controls and a recovery email on the company domain.
What happens if no SMS arrives on a rented number?
Every MarioSMS activation has a timer. If no SMS arrives before the window closes, the activation cancels and the price returns to your balance. Start a new one and pick a different country if one keeps failing.
Can we move an existing account to a new number?
Usually yes, from the security settings, as long as you can still log in and pass the current check. Do it during business hours with the old number still reachable, since some platforms send a confirmation to both.
How many numbers does a small agency need?
One activation per verification, not one number per person. A five-client agency running Instagram and TikTok handles needs about ten activations at setup, then occasional ones for re-checks. At $0.04 and up per number, that is a small line item.
Is a second account allowed for testing?
QA and OTP testing on accounts you own is fine, as is a brand handle kept apart from a personal one. Evading a ban or posing as another person is not. See our acceptable use rules.
Where do we store the recovery codes?
In the shared vault, next to the password, with the date they were generated. Print one copy for the safe if the account carries real revenue.