The five things that actually protect a business messaging account

Five things, in order of how often their absence causes an actual incident: two-step verification the business knows, two admins, a leaver routine, scoped API keys, and somewhere the SIM physically lives.

1. Two-step verification, known by the business

The PIN is what stops somebody who obtains your SIM or intercepts a code from taking the number. Set it, and store it where the company controls it rather than in one person's memory - the full version, including the cooling-off period that makes forgetting it expensive.

2. Two admins, both with two-factor

One admin is a single point of failure with a notice period and a phone that can be lost. Two is the minimum for any account that matters, and both need two-factor on their own logins - the account is only as protected as the weakest admin.

3. A leaver routine that includes messaging

Messaging is rarely on the offboarding list beside email and payroll. It should be, and it has an extra step nobody expects: removing somebody's access can stop messaging entirely if a token was issued from their account - the Page token problem.

4. Scoped keys, rotatable

An integration that only sends should not be able to read the inbox. A key per integration, named, with a last-used timestamp, so an unfamiliar one can be revoked with confidence - see API keys.

5. The SIM, and where it lives

Recovery, re-verification and moving to a new handset all need the physical SIM, usually urgently. It belongs in a safe with the PIN and a note of which account it is registered to - three facts that are only useful together.

A yearly check

1. Who has admin? Are they all still here?
2. Is the PIN in the company password manager, and does it work?
3. Which API keys exist, and when was each last used?
4. Does the leaver checklist mention messaging?
5. Where is the SIM?