A password on a sticky note usually means somebody needed a way to get the work done. Maybe several people share a login. Maybe account recovery depends on a former employee. Maybe the password rules are so awkward that nobody remembers what changed last week.
Shaming the person who wrote the note will not fix those conditions. Start by making the approved way to sign in easier to follow and easier to recover.
Find out what the note is compensating for
Ask which account it opens, who needs it, and what happens if the note disappears. Do not photograph or copy the password into an ordinary task list. Record the account and the access problem instead.
A shared shipping account is different from an employee’s personal account. You need to know whether the service supports individual users, delegated access, or an approved shared credential. The service’s account rules matter as much as convenience.
Give each person an accountable way in
Where a system supports separate users, use them. It becomes easier to remove one person’s access without changing the whole office’s routine. It also makes it clearer who owns recovery and approval.
For credentials that legitimately need to be shared, an organization-managed password manager can provide a controlled alternative to a note or group text. Choose who may view or use each entry. Do not turn the shared vault into another place where everyone can see everything.
Make strong passwords manageable
CISA recommends strong, unique passwords and a password manager to create and store them. Reusing the same password across business accounts lets one exposed credential become several problems.
Start with the accounts that would be hardest to lose: business email, financial systems, administration, and the password manager itself. Plan recovery before replacing the old method. Include multifactor authentication where supported, and make sure an approved backup method exists.
Practice the employee-change scenario
Imagine the office manager is unavailable tomorrow. Can an authorized person still reach the business accounts without borrowing their identity? Now imagine that employee leaves. Can you remove access without losing the files or disrupting billing?
Those are useful tests of the process. Write down the owner, the recovery route, and the access-removal step. Keep actual recovery secrets in the approved secure location, not in the procedure.
The useful outcome is not a cleaner desk. It is a business that can grant, recover, and remove access deliberately. Replace the workaround with a system people can actually use, then retire the sticky note safely.