Multi-Factor Authentication (MFA) is essential for cybersecurity, but it is also one of the most common causes of non-profit operational lockouts when a tech volunteer leaves. When tech-savvy volunteers configure MFA on shared tools—such as Mailchimp, QuickBooks, or social media accounts—they frequently connect authentication apps or SMS verification codes directly to their personal smartphones.
When that volunteer leaves, staff members suddenly find themselves locked out of vital tools despite knowing the correct username and password. To prevent this disruption, perform an immediate MFA verification audit on all shared operational platforms.
Start by having the departing volunteer log in with you during an exit transition session. Transfer the multi-factor authentication mechanism from their personal device to a centralized, organization-controlled platform. Use a team-wide password management platform (like Bitwarden or 1Password) that includes built-in Time-based One-Time Password (TOTP) authenticator tools. This allows authorized staff to generate secure MFA codes directly from a shared, encrypted vault without relying on anyone’s individual phone.
If a volunteer has already departed and you cannot log in, immediately locate the platform’s “Account Recovery” or “Emergency Backup Codes.” When MFA is initially activated, platforms generate a list of one-time emergency backup codes. Keep these recovery keys stored in an encrypted organizational archive. Taking these proactive steps ensures high security while protecting access continuity.