The Keys Are in a Coat Pocket: Rehearsing MFA Recovery for a Small UK Firm

Most MFA advice focuses on turning it on. Fair enough — it is one of the best cheap defences a small firm has. The awkward part comes later, when the phone holding the authenticator app is dropped in a puddle, left in a taxi, or sitting in the pocket of someone who has just handed in their notice.

That is not a security failure in itself. It becomes one when nobody knows which accounts depend on that phone, where the backup codes are, or who can approve a reset. The goal is not to avoid ever losing a device. The goal is to make losing one a manageable Tuesday problem rather than a week-long lockout.

Start with a map, not a panic

Before you change anything, make a list. Not a vague mental list — an actual one, stored somewhere you can reach without the missing phone. For a typical UK small business, it might include Microsoft 365 or Google Workspace, the finance system, online banking, the domain registrar, the website admin, the backup console, payroll, HR, remote access, and the social media accounts nobody admits to owning.

For each one, note:

• who is enrolled in MFA and with what method — authenticator app, SMS, hardware key, passkey;
• whether there is a second method or a set of backup codes;
• where those codes live, if they exist at all;
• which email address or phone number is used for recovery;
• who holds admin rights.

A spreadsheet is fine. A secure note in your password manager is better, as long as you can get into the password manager without the missing phone. That last point catches people out more often than you would think.

The break-glass account is useful, not a skeleton key

A break-glass account is an emergency admin login kept out of daily use. It exists so that when normal access fails, someone can still get in and fix things. It should not be Sharon’s everyday account with a sticky note on the monitor.

Keep it separate, give it a long unique password, and protect it with a method that does not live on the same phone as everyone else’s authenticator. A hardware security key kept in the office safe, plus a sealed envelope with recovery details, is a reasonable small-firm approach. Limit who knows about it, but make sure at least two people can reach it. An emergency route that only one person knows is just another single point of failure.

Use it rarely, and make sure sign-in alerts are switched on so you know if it is used. If your provider supports it, give the account the minimum admin role needed for recovery rather than making it all-powerful for no reason.

A second device is not the same as a spare phone in a drawer

Many providers let you register more than one authenticator or security key. Do that at setup, not after the incident. An old handset kept charged in the office can work, but it needs to be enrolled, tested and stored securely. A hardware key on a lanyard in the safe is often less fiddly.

Print the backup codes. Yes, paper has its own risks, but an email in the same inbox you cannot access is not a backup. Put one copy in the safe and consider a second sealed copy with a trusted adviser or director. Check the codes are still valid — some providers expire them or invalidate them when methods change.

Decide who can actually press the button

Recovery is not only technical. It is procedural. If the finance director is unreachable, who can call the bank? If the managing director’s phone is gone, who can contact the domain registrar? Write down the support routes for your main suppliers: account numbers, admin contact details, support phone numbers and expected response times. UK support hours matter; a Friday afternoon problem can become a weekend problem if the only contact route is a web form.

Name a deputy for each critical service. Make sure the recovery email address is a group mailbox or shared alias rather than one person’s inbox. For banking and payroll, use dual approval where available. The aim is not to distrust people; it is to stop one absent phone from freezing the whole firm.

Rehearse the awkward bit

A 30-minute walkthrough is enough to expose most gaps. Pick a quiet day and ask: if this phone disappeared now, what would we do first? Can we open the password manager? Can we reach the break-glass account? Are the backup codes where we think they are? Does the deputy know what they are looking for?

Do not disable MFA globally to test it. That is the mistake that turns a bad morning into a bad month. Use a test account, review the provider’s recovery process, or walk through the first few steps without completing a risky reset. Record the date, note what failed and fix one thing before the next check.

The mistakes that make it worse

Switching off MFA for everyone because one person is locked out is the big one. It solves the immediate annoyance and creates a much larger problem. Other common traps include sharing one SMS number across the company, keeping backup codes in the same email account, letting the break-glass account become a daily login, and forgetting to remove MFA methods when someone leaves.

Running a quick review now is cheaper than discovering the gap during a Monday morning lockout. List your top ten services, give each one an owner and a backup route, seal the codes, enrol a second device and test one recovery path. It is not glamorous, but it is the difference between a firm that can recover and a firm that is waiting on hold while the coffee goes cold.