Growing your business to the point where you can actually hire help is a huge achievement. It, hopefully, means your cash flow can support it and that you’ll finally be able to stop doing a few of the enormous number of things you’ve been doing.
Most new hires are contractors. Maybe you started with a virtual assistant, a marketing agency, a bookkeeper, or an IT company.
One of the biggest mistakes most people make when they start hiring contractors, including me, is not thinking through and addressing the IT risks that come from hiring them. This is important because when you hand off work, you hand over access to at least some of your systems.
It’s like giving them the keys to what keeps your business running. It could be your email, calendar, ad accounts, social media accounts, or customer data.
And because they’re contractors, and not employees, you can’t manage them in the same way you’d manage someone on your payroll. This difference is where trouble can start without anyone aware that it’s happening.
How Do You Wind Up NOT Owning the Accounts Your Business Runs On?
You end up there one reasonable decision about software and app access at a time.
You hire someone to set up your Google Business Profile so you can finally show up in local search.
You hire someone to run your Google Ads because you don’t have the time or desire to learn the platform.
Or you hire someone to set up your analytics, buy your domain, and build and manage your website.
Each of these decisions can be exactly the right call. You needed the help, and you got it.
Where things can get messy is when you decide to part ways with the contractor, or they decide to leave, and you discover the accounts running each of these systems aren’t yours. They’re all in the agency’s or contractor’s name.
I’ve seen this happen too many times. A business owner hires a marketing company to set things up and run them, and the marketing company owns the systems. Getting all of this changed is painful. What I’ve noticed is that the company uses its systems ownership to “encourage” their clients to stick around for the long haul.
Nobody can know what they don’t know before someone tells them. The result is that way too many business owners don’t own the accounts their business runs on.
Because a contractor isn’t an employee, contractors work according to their standards UNLESS you set the standards before signing any agreement.
What Happens When a Contractor Owns Your Accounts Instead of You
Several years ago, I hired a contractor who set up my presence on Meta, my Facebook and Instagram for the business. They knew the platform better than I did, and I didn’t want to have to mess with it. They built it out, and it looked great.
The problem was that they built it under their name instead of mine.
When they left, I was locked out of my own account for several months. I couldn’t get in. The contractor wouldn’t respond to my emails, texts, or calls.
I only got back in because I happened to know someone who knew how to reach the person. Once the person understood what had happened, they immediately transferred everything to me.
So, I was lucky, very lucky.
How Do You Keep Control of Your Systems When You Hire a Contractor?
You set the standard that you own every account and every credential before anyone gets access. The contractor is simply a delegate.
Why Letting Someone Go Doesn’t Mean They’re Actually Gone
I learned this the hard way.
I hired a VA and gave them access to several systems so they could take over what I wanted them to. Unfortunately, they didn’t work out, so I changed the passwords for all the systems they had access to, let them go, and assumed I was done.
But it wasn’t done.
Back then, changing a password didn’t end all the Google sessions that were already open. As long as this person stayed logged in, their session was live, and they could access it whenever they wanted.
And what this person decided they wanted was my calendar. They used my calendar to get a prospect’s email address.
This VA created a new email address using my name and used it to send that prospect a $16,000 invoice for a conversation.
I’m sure you can imagine my shock when I got a scathing email from the prospect. She told me she would not pay me anything and that she had blocked that email address, believing it was me. Her fury jumped off the screen. And I didn’t blame her one tiny bit.
I was upset and tried calling her to get more information about what had happened. She refused to answer my call. Makes sense, right?
Luckily, a friend of mine was able to get hold of her to explain what had happened and that the invoice was fraudulent.
There it was, lucky again, just like I was with the Meta situation. The problem is that luck isn’t a system. And you can’t count on it.
How Much Can a Contractor’s Misused Access Actually Cost You?
A contractor’s access can cost you anything from a few wasted hours, stress, and some lost sleep to tens of thousands of dollars, depending on what that access can reach. If it’s just a calendar and a contact, you’re on the “wasted hours, stress, and lost sleep” side of the spectrum. If it touches client data or payment information, you’re on the other. That’s the scary side. And you’re looking at big fines.
Client data and payment information breaches are far from rare. Verizon’s 2025 Data Breach Investigations Report found that the share of breaches involving a third party (contractors) doubled in one year to 30%. Verizon also reports that stolen or misused credentials were the way in for 22% of the breaches.
The most common breaches Verizon found at small and midsize companies were ransomware. Yup, the same size as your company. 88% of all the breaches at these companies were ransomware.
So, when you give someone access, you’re handing over everything that login can reach. Most people never think about that before handing access over.
And the FTC is blunt about who’s responsible when you bring in outside help. You are. Not the contractor who enabled it to happen, but you.
You can’t set a standard for something you don’t fully understand. And most business owners don’t fully understand their own systems.
This is why bringing in an MSP (Managed Services Provider) or an IT professional is so often the right move. Setting the standard is what makes it safe to hand the keys to a pro in the first place, and a good one will help you retain control and remain protected instead of taking ownership for themselves.
Once your ownership is secured, the next job is creating SOPs to document how it all works and the best ways to onboard and offboard users from the systems.
If you’re hiring help and you want to be sure you’re keeping ownership of what your business runs on, let’s talk. Book a 15-minute call.
About the Author
Karen Finn, PhD is an author and business growth strategist. Download a copy of her book, The Business Growth Plan, to get insight into the low-cost and no-cost strategies she uses with her clients to 2x-3x their revenues.
