Bookkeeper Access to Bank Accounts: Read-Only, Logins and Fraud

How do I safely give a bookkeeper access to my financials?

Give each person their own login, limit it to what the job needs, and never let one person both start and approve a payment. Those three rules come from NIST's small-business security guide: a separate account for every user, contractors included; access only to the systems and information a person needs; and no single person who both initiates and approves a transaction, executives and senior managers included.

A bookkeeper who only records transactions does not need your personal accounts, accounts of other entities you own, employee Social Security numbers and bank details (unless the bookkeeper runs payroll), or any ability to add a payee or change one. That is the answer to what to keep out of view: whatever the books do not need.

A case is not simple when:

• the bookkeeper holds the only admin login to the software or the bank;
• the same person records the books and sends the payments;
• the bookkeeper also pays vendors or runs payroll;
• a password is shared by several people;
• a partnership or corporation has several owners, so it is unclear whose approval counts;
• a change of vendor bank details or a payment you do not recognize has already appeared.

If the bookkeeper holds the only admin login, also sends payments, or something odd has already appeared, read the last section, "Different for you?", before the rest.

Gather first: a list of every bank, card, payroll and software account, who can log in to each and with what role; the roles each bank offers; and the payroll provider's user list.

How do I give a bookkeeper access to the accounting software without sharing my login?

Invite the bookkeeper as a separate user with only the permissions the work needs, and keep the primary admin login yourself. Most accounting software lets the owner do this; names and steps differ by product, so read your product's help page. Before you pick a role, ask the software provider whether it can add or change payees, release payments, change payout details or give others access. Keep payment release with another person.

A role's name does not show what it can do, so do not assume it is read-only. A separate login does not limit the role; it means changes can be traced to the bookkeeper's own login. NIST warns that without individual accounts it is hard to investigate data loss or unauthorized changes. If your software keeps a record of who changed what, look at it.

If the bookkeeper created the file or holds the only admin login, change that first. See replacing your bookkeeper for how to take admin control back.

Can a bookkeeper have read-only access to my bank without being able to move money?

Sometimes, but whether a read-only role exists depends on the bank. No government source describes bank user roles, and they differ by bank and account type, so ask the bank before relying on any role. Ask in writing:

1. Which roles exist, and is there one that can view accounts and statements but cannot start, approve or release a payment, add a payee or change a limit?
2. Can the bookkeeper have a separate login, so you never share yours?
3. Can a payment require approval from a second user?
4. What can a connection from the bank to the accounting software do, and who sets it up?
5. Will the bank confirm the answers in writing?

A bank feed is a link from the bank to the accounting software that brings in transactions. What a given link can do is the bank's answer to question 4, not something this page can promise, and a feed does not prove the books match the bank (see bank feeds are not reconciliation).

If the only option is full access, send the statements yourself each month instead of sharing your banking login. NIST advises that, where possible, no employee should have access to all of a business's information or systems.

Which logins should stay with me only?

Keep every login that can move money, add a person or change who gets paid, plus the tax accounts the business is legally responsible for.

For IRS records, Form 8821 lets you name any individual or firm to inspect and receive your confidential tax information for the tax types and periods you list. It does not let them speak for you before the IRS. Form 2848 does that, but only for someone eligible to practice before the IRS.

In Business Tax Account, the IRS's online account for businesses, a Designated Official or sole proprietor can add a Designated User. The user signs in with their own identity, needs a Social Security number or ITIN, and does not have to be an owner or officer. The Designated Official or sole proprietor chooses the tax forms, periods and permissions, which can include making payments; a bookkeeper who only needs records does not need payment permission. That person must revalidate the user every January and June.

Not every business can have the account. The IRS says it is not yet available to an LLC that files as a sole proprietor on Schedule C or Schedule F, and those owners use Form 8821 instead. For which authorization a new accountant needs and how to end an old one, see switching accountants.

The IRS also strongly suggests that you not change your address of record to a payroll provider's, because IRS notices about your account would then go to someone else.

Who should approve payments, and why shouldn't the person who records also pay?

Limiting who can release payments is the main way to keep recording apart from paying; it lowers the risk and does not remove it. The person who records payments should not also send them, because then nobody else sees the entry that hides a bad payment. That reasoning is this page's; NIST's rule is narrower: no single person should both initiate and approve a transaction, executives and senior managers included.

A workable split:

1. The bookkeeper enters bills and prepares the list of what is due.
2. You, a co-owner or another named person approves the list and releases the payments.
3. The bookkeeper records what was paid, from the bank's record.
4. You review the bank activity directly, not through the bookkeeper's reports.

If you are the only owner, you are the approving person and the bookkeeper only prepares. If you both start and release payments, nobody else approves them, so NIST's rule is not met. Reading the bank activity monthly, or having an outside person see the statements, catches a problem after the fact; it is not a second approval.

With several owners, decide in writing who may release payments and who may approve a new payee, and check that the people the bank lists as authorized match. If owners disagree about who holds the bank admin login, settle that first.

How do I turn on a second login step and stop passing passwords around?

Turn on multifactor authentication, also called two-step login, on every account that offers it, and give each person their own login instead of a shared password. CISA explains that the second step protects an account even when someone steals the password.

• Where: in each account's settings, under Security. It may be called two-factor or two-step authentication. CISA gives a code sent by text or email, an authenticator app and fingerprint or face recognition as examples. Start with the bank, the accounting software, the payroll provider and your email.
• Passwords: CISA recommends at least 16 characters, random, different for each account, stored in a password manager rather than written down.
• Sharing: the FBI's Internet Crime Complaint Center (IC3) advises against supplying login credentials by email. Give the bookkeeper a login of their own, not yours.

If my bookkeeper also pays bills or runs payroll, what do I still check myself?

For payroll, you still check that deposits were made, because the employer generally stays responsible for them whoever does the work. The IRS says the employer is ultimately responsible for federal payroll tax deposits and can be liable for the taxes, penalties and interest if a third party does not pay.

A person can also owe the withheld taxes personally. Under section 6672, a person required to collect and pay over withheld taxes who willfully fails to is liable for a penalty of 100% of the unpaid amount. The IRS treats as responsible a person with the duty and power to direct that payment, and lists officers, directors, shareholders, partnership members and employees, and payroll service providers as examples. See the trust fund recovery penalty guide for the tests and the response deadlines.

For bills, the check is your own review of the bank activity.

• Payroll deposits: the IRS says to register for EFTPS yourself, get your own PIN, and use it to check that deposits were made under your employer number. It treats the first missed or late payment as a red flag.
• A certified professional employer organization (CPEO): it is generally the sole employer for tax purposes for wages it pays to work site employees (26 USC 3511) and deposits under its own number, so its customers cannot see those deposits in EFTPS. Ask the CPEO for proof of payment instead.
• Payroll tax notices: these go to the address on file with the IRS, so keep it yours.
• Everything else: the monthly bank review and the callback rule below apply here too.

If a provider failed to deposit, see what to do when a payroll provider did not pay your taxes.

What controls catch theft or errors early?

Four owner checks help catch theft or errors early: read the bank activity, review who has access, read the reconciliation reports, and approve every change to payee details. None depends on the bookkeeper.

The IC3 advises regular monitoring of financial accounts for irregularities such as missing deposits; reading business statements monthly applies the same idea.

For what a real reconciliation shows, see checking your bookkeeper's work and bank feeds are not reconciliation.

How do fake invoices and changed bank details work, and what is the callback rule?

In business email compromise, criminals use a taken-over or look-alike email account to ask for a transfer or for new account details, and the IC3 reports it targets small local businesses as well as large corporations. Its announcement tallies reported exposed losses of $55.5 billion over roughly ten years.

The callback rule is to verify any change of payment details through a second channel before acting. The IC3 advises using secondary channels to verify requests for changes in account information.

1. Treat a request to pay a new account, or to change a vendor's bank details, as unverified, even if it appears to come from a vendor or from the bookkeeper's own email.
2. Find the vendor's phone number from something you had before the request, such as an earlier invoice or the contract. Do not use a number or link in the message. CISA gives the same advice for suspicious messages.
3. Ask the vendor to confirm both the old and the new details.
4. Write down who confirmed and when, and have the person who approves payments approve the change.

The IC3 also says to check that a sender's address and links match the real business, since links can hide a misspelling of the real domain name.

What if money goes missing: what do I do first, and is the loss deductible?

Act on the money first, then the access, then the tax. If a transfer was fraudulent, the IC3 says time is of the essence: contact your bank right away to ask for a recall of the funds, and file a complaint at ic3.gov whatever the amount.

1. Money: call the bank and ask for a recall. Ask what time limit its account agreement sets for reporting an unauthorized payment: Regulation E covers accounts held primarily for personal, family or household purposes, so a business account is generally outside it.
2. Access: remove the person's logins, change every password they knew and turn on a second login step.
3. Records: keep statements, emails, invoices and the software's list of changes before anything is edited.
4. Tax: a theft deduction has timing and proof rules, set out below.

Whether the loss is deductible depends on facts and on state law. IRS Publication 547 treats embezzlement as theft. A theft is the illegal taking of money or property with criminal intent under the state's law, and no conviction is needed. The IRS also counts taking money or property through fraud or misrepresentation if that is illegal under state or local law, so a payment sent to a fake payee may qualify. A simple disappearance of money, or a bookkeeping mistake without criminal intent, is not theft; for mistakes see who pays the penalties when a bookkeeper makes mistakes.

When a loss can be deducted:

• A theft loss that is not reimbursable is deductible only in the year you discover the theft.
• If there is a claim for reimbursement with a reasonable prospect of recovery, such as from the bank, an insurer or the thief, that part is not deducted until you know with reasonable certainty it will not be repaid.
• How the amount is figured depends on what was taken, and reimbursement received or expected reduces it.
• The loss is figured on Form 4684, Section B. A partnership or S corporation then reports it on its Schedule K, so it passes to the owners. A sole proprietor carries it to Schedule 1 (Form 1040), and a C corporation follows the instructions for its own return. Form 4797 may be required instead.

A payment sent to a scammer, such as a fake vendor account, also has its own conditions in Publication 547 under losses from financial scams: the loss must result from criminal conduct classified as theft under state law, there must be no reasonable prospect of recovering the funds, and the transaction must have been entered into for profit.

The books may have recorded the missing money as ordinary expenses in earlier years, so how the loss and those years fit together is a question for a professional. See the IRS instructions before you file.

How do I remove access when the work ends?

Remove each of the person's logins when the work ends, starting with the ones that touch money. If a new bookkeeper is taking over, remove an account's access once the new login to it works, unless money is missing: then cut bank, card and payroll-funding access first. NIST says that when someone leaves, ensure they no longer have access: delete their account from all systems and change any shared passwords they knew.

• Accounting software: an admin removes the bookkeeper from the list of users in the software's settings, then checks the list to confirm access has ended. Follow the software provider's instructions.
• Bank: have the bank remove the user and any connection to the software.
• Payroll provider, payment apps, card portals and shared storage: remove the user in each.
• Anything shared: change the password, and reset the second-step device if they held one.
• Tax authorizations: if you signed a Form 8821 or 2848, revoke it in writing as the instructions for Form 8821 or Form 2848 explain. If you added the bookkeeper as a Designated User in Business Tax Account, end that access there. If the bookkeeper or a payroll firm is also your reporting agent on Form 8655, revoke that separately: a new Form 8655 ends the old agent's authority only from the period it names, and the old agent keeps disclosure authority for earlier periods unless you revoke it. See switching payroll providers.

For the full handover, including the file, closed months and filing dates, see replacing your bookkeeper.

Example

These examples are illustrative; all figures are in US dollars.

A remote bookkeeper for a dental practice

A dental practice with US$900,000 of revenue hires a remote bookkeeper. The owner invites her as a separate user in the software after checking that her permissions cannot release payments or change payees, sends the bank statements every month and keeps the bank admin login. The bookkeeper prepares the weekly list of bills; only the owner approves and releases payments. The owner turns on a second login step at the bank and in the software.

A shared password at a single-member LLC

A single-member LLC with US$150,000 of revenue has used one password for years, and a former helper still knows it. The owner creates a separate login for herself and for the current bookkeeper, changes every password the helper knew and turns on a second login step. She reads the last months of bank activity for payments she does not recognize and, where the software keeps a change log, checks who made recent changes.

The same email, two setups

An email from a look-alike address asks a contractor to send the next US$18,000 invoice to a new account. Where the bookkeeper only prepares the list and the owner releases payments, the owner sees the new account, calls the number in the signed contract, and the vendor says it sent no change. Where the same bookkeeper also releases payments, the money goes out. The owner finds it on the statement weeks later, asks the bank for a recall and removes the bookkeeper's logins. The books show the payment as an ordinary vendor bill, so correcting them and sorting out any loss is a question for a professional.

Different for you?

• The same person records and pays, the bookkeeper holds the only admin login, or owners disagree about who approves: this removes the second person NIST says should stand between starting and approving a payment. Settle who holds each access, how payments are approved and what you review monthly, with bookkeeping help.
• A bank-detail change or an odd payment has already appeared, or you suspect a loss: act on the money first. Theft-loss timing and earlier-year books depend on the facts, so have the affected months reviewed with bookkeeping help before a return relies on them.
• You are not sure the books are right: see checking your bookkeeper's work.
• You have not hired yet: see the questions to ask before hiring a bookkeeper, what the bookkeeper needs from you and local or online bookkeepers.
• The bookkeeper is overseas: see hiring an offshore bookkeeper.
• Your payroll provider did not pay your taxes: follow the payroll provider guide.
• You want to end the relationship: see replacing your bookkeeper.