My Reputation Agency Won't Give Me My Accounts Back: What to Do

If your reputation management company won't give you the passwords to the profiles, websites, and domains it created in your name, start by gathering your contract and a list of every account involved. Then make one clear written request for access. If that fails, many platforms have their own recovery or ownership processes that don't depend on the agency's cooperation. For a real contract dispute, talk to an attorney.

This is a common frustration with traditional reputation management. A campaign builds dozens of assets—a personal website, social profiles, articles, directory listings—and the client often never sees the logins. When the relationship ends, the client discovers that the accounts carrying their name belong, in practice, to someone else.

The good news: much of what was built can usually be recovered or rebuilt. Here is how to approach it calmly and in the right order.

Why agencies keep the credentials

Not every agency that holds credentials is acting in bad faith. There are a few common reasons:

• Operational convenience. The agency publishes and updates content constantly, and managing logins centrally is simpler for them.
• Shared infrastructure. Some agencies register domains, hosting, or email addresses under their own accounts so they can manage many clients at once.
• Retention. Less charitably, holding the accounts makes leaving harder. If cancelling means losing the assets that push negative results down, clients are less likely to cancel.

Whatever the reason, the effect is the same: you paid for a campaign, but you may not control the results of it.

What you're usually entitled to (start with your contract)

What you are entitled to depends on your agreement, the platforms involved, and the law where you are. This article is not legal advice. But a few questions are worth answering before you do anything else:

1. Does the contract mention ownership of accounts, content, or intellectual property? Look for words like “deliverables,” “work product,” “assets,” “ownership,” and “termination.”
2. What happens at termination? Some agreements describe a handover process; others say nothing.
3. Who is the named registrant or account holder? A domain registered in your name is in a very different position from one registered to the agency.
4. Are there unpaid invoices? A billing dispute can complicate a handover, even when it shouldn't block it.

If the contract is unclear, or the agency refuses a reasonable request, a short consultation with an attorney who handles contract or business disputes is usually money well spent. An attorney can tell you what you're owed and how to ask for it effectively.

Step 1: Make an inventory

Before contacting anyone, list every asset you know about. Your reports from the agency, old invoices, and a search of your own name are good starting points. For each item, note:

• The URL
• The platform (personal website, Medium, LinkedIn, YouTube, directory, etc.)
• The email address the account appears to use, if known
• Whether it ranks for your name today

Running a Free Reputation Snapshot can help you see which pages currently appear for your name in Google, Bing, and AI answers, so you know which assets matter most.

Step 2: Send one clear, written request

Keep it short and factual. Ask for:

• Login credentials (or an ownership transfer) for each account on your list
• Domain transfer authorization for any domains in your name
• Copies of all content, images, and files created for you
• Confirmation of which email addresses were used to open each account

Give a reasonable deadline. Save the request and every reply. If the agency cooperates, change every password and recovery email immediately after the handover.

Step 3: Recover accounts through the platforms directly

If the agency won't cooperate, the platforms themselves are often your best route.

Your domain name

The domain is usually the most important asset, because your personal website sits on it.

• Look up the domain's registrar using ICANN's lookup tool. Registrant details are often hidden for privacy, but the registrar's name is shown.
• If you are the registrant, ICANN's Transfer Policy requires the registrar to either let you generate the transfer code (called an Auth-Code or AuthInfo code) yourself or provide it within five calendar days of your request. Under that policy, a registrar also cannot refuse to release the code solely because of a payment dispute between you and the registrar.
• If the registrar doesn't comply, ICANN accepts transfer complaints through its Contractual Compliance process.
• If the agency is the registrant, the domain is registered in their name, and recovering it is usually a matter for your contract—and possibly your attorney.

Google Business Profile

If someone else holds the verified Business Profile for your business, Google lets you request ownership. Search for your business at business.google.com/add, select Request access, and fill out the form. Google notifies the current owner, who has three days to respond. If they don't respond, you may have the option to claim and verify the profile yourself; if they deny the request, Google offers an appeal path. (Service-area businesses without a storefront contact Google support instead.)

Social and publishing profiles

Most major platforms offer account recovery tied to the email address or phone number on the account. If the account was opened with an email you control, use the platform's “forgot password” flow. If it was opened with the agency's email, check the platform's help center for identity-verification or impersonation processes. Each platform handles this differently, so follow its current instructions.

Accounts you can't recover

Some accounts simply won't come back. In that case, document the URL, and focus on building a new, properly owned replacement.

What happens to suppression content if the accounts go dark

This is the part clients worry about most, and for good reason. Suppression works by placing strong, accurate pages above the negative ones. If those pages are deleted, abandoned, or allowed to expire, they can lose rankings over time, and the results they were pushing down can rise again.

A few things to watch for:

• Domain expiration. If an agency stops renewing a domain, the site goes offline. Expired domains can also be re-registered by someone else.
• Deleted profiles. If an agency deletes content when you leave, those positions on page one open up.
• Stale content. Pages that are never updated may gradually weaken against fresher results.

How fast this happens varies and can't be predicted with certainty. For context on how rankings build in the first place, see how long online reputation suppression takes.

If you lose an important asset, rebuilding it on accounts you own is usually the right move. A new personal website, an updated LinkedIn profile, and fresh articles on platforms you control give you a foundation no one can take away. Our guide to suppressing negative search results walks through which assets tend to matter most.

How to avoid this next time

Whoever you work with next, ask these questions before you sign:

• Whose name and email will each account be registered under? The answer should be yours.
• Who will be the registrant on the domain? Again, you.
• Will I have the passwords from day one? Not “at the end of the contract.”
• What happens to the content if I cancel? Get the answer in writing.
• What's the minimum term? Long minimums combined with agency-held accounts are a red flag.

It also helps to understand what reputation management typically costs, so you can judge whether a quote reflects real work.

The Mirror.fyi approach: you publish and own everything

Mirror.fyi was built partly because of this exact problem. The platform analyzes what Google, Bing, and AI answers say about you, builds your strategy, and writes the content. You create the accounts and publish the work, so every login, domain, and profile is in your name from the start. The portal includes an encrypted Account Keys vault to keep track of the credentials you create, and you can cancel anytime without losing anything you built on those external accounts.

Mirror.fyi never posts or contacts anyone on your behalf. That's a deliberate design choice: what carries your name stays yours. If you want to understand the strategy behind it, the Mirror.fyi Reputation Guide covers how each asset fits together.

See where you stand today. Before deciding what to rebuild, run a Free Reputation Snapshot. It checks one search term across Google, Bing & Yahoo, ChatGPT, and Perplexity, and shows which results matter most—no card required.