Securing QuickBooks Online and cloud accounting apps

An attacker with access to your accounting system can change a vendor's bank details so the next payment goes to them, create fake vendors or invoices, read payroll and banking information, or send convincing invoices to your customers from your own system. Many of these frauds start with a stolen password and only become visible when a supplier calls asking why they were not paid.

The risk is shared across several parties: your staff, your outside bookkeeper or accountant, and every app connected to the platform. Controls have to cover all three. The Canadian Centre for Cyber Security's baseline controls for small and medium organizations (strong authentication, access control, securing cloud and outsourced services) apply directly.

QuickBooks Online lets you assign roles that limit what each person can see and do. Intuit's documentation describes a primary admin (assigned to whoever set up the account) who can grant company admin rights to others, plus more limited standard, custom and accountant roles depending on your plan.

• Keep the primary admin with an owner or senior officer, not a departed bookkeeper or an outside firm.
• Give staff the narrowest role that fits: someone entering bills does not need to approve payments or change bank details.
• Invite your external accountant or bookkeeper as their own user, through their own login. Never share a staff login with them.
• Separate duties where you can: the person who adds or edits vendors should not be the only person who releases payments.
• Review the user list quarterly and after any staff or accounting-firm change. Remove users who no longer need access the same day they leave.

• Turn on multi-factor authentication for every user's Intuit account, not just the admin. Prefer an authenticator app over text messages where available.
• Use a long, unique password stored in a password manager; never reuse the same password as email.
• Protect the email account linked to each login, because password resets go there. A compromised mailbox is often how accounting accounts are taken over.
• Make sure the recovery phone number and email on the account belong to the business and are current.
• Sign in only from company-managed devices for anyone who can pay bills or change bank details.

Cloud accounting platforms connect to banks, payroll, payment processors, expense tools, inventory systems and reporting add-ons. Each connection is granted access to your books and sometimes to write data back.

Review connected apps at least twice a year. Remove any that are no longer used, any the current team cannot explain, and any connected by a former employee or old accounting firm. Bank feed connections should be authorized by an owner, and the bank's own online banking should have its own MFA and payment approval rules.

• Use your bank's dual-approval feature for payments and for adding or changing payees where offered.
• Treat every request to change vendor banking details as suspicious until verified by phone on a number already on file, not one in the email.
• Turn on notifications for new payees and large payments where your bank supports them.

QuickBooks Online keeps an audit log. Intuit says it records user sign-ins, changes to QuickBooks settings, edits to customers, vendors and employees, and payroll submissions, and can be used to find deleted transactions. Other platforms have equivalents.

Look at it regularly, not only after a problem: changes to vendor bank details, new users, and sign-ins at unusual times are worth a monthly glance. If you suspect fraud, export the log before changing anything, so the record of what happened is preserved.

1. 01

   When someone leaves

   Remove their user the same day, rotate any shared credentials they knew, and check that they were not the primary admin or the owner of bank or payroll connections.

2. 02

   When you change accounting firms

   Remove the old firm's users, review connected apps they set up, and confirm they no longer hold credentials.

3. 03

   If you suspect fraud

   Contact your bank immediately to try to stop or recall payments, preserve the audit log and related emails, reset credentials and MFA, and check linked email accounts for forwarding rules.

4. 04

   Report it

   Report fraud to your local police and to the Canadian Anti-Fraud Centre (online through reportcyberandfraud.canada.ca, or by phone at 1-888-495-8501).