How to Keep Your QuickBooks Online Account Secure: Prevent, Detect, and Respond

Cybersecurity Awareness Month is a good reminder that to protect your business, you need more than strong passwords and two-factor authentication. You—and your team—need good habits, ongoing awareness, and a clear plan for how to respond when something unusual happens.

Of all the data your business needs to protect, your financial data is among the most sensitive. As QuickBooks Solution Providers, we want you to be informed, prepared, and confident so your team can recognize potential issues early and take the right steps to protect your business.

In this article, we’ll walk through how to keep your QuickBooks Online account secure, what to do if you suspect unauthorized activity, and how Intuit is prepared to help you swiftly secure your account and investigate any security threats.

How to Keep Your QuickBooks Online Account Secure

Keeping your QuickBooks account secure starts with a few consistent habits. Use strong, unique passwords, turn on two-factor authentication, and make sure everyone who accesses QuickBooks has their own login instead of sharing credentials.

User access should also match each person’s role. Give employees, bookkeepers, payroll staff, and outside advisors only the permissions they need, and review your user list regularly so former employees or vendors do not retain access longer than necessary. Make sure that you, the business owner, are the primary admin on your QuickBooks account, and the account is associated with your legal name and an email address you have access to. This is especially important if another party, like your accountant or a former business partner, set up the QuickBooks account in the first place. Should you need Intuit’s assistance in recovering the account, this will be essential to verify your identity and restore access.

Security also depends on good judgment outside of your QuickBooks account. Be cautious with unexpected emails, texts, and phone calls that ask you to sign in, verify your identity, or share a code. Familiarize yourself with official Intuit Payments email addresses, and when in doubt, navigate directly to QuickBooks.com rather than clicking a link or calling a phone number from an email or text message.

Lastly, pay careful attention to account notifications. Alerts about new users, password changes, or other account activity can help you catch unusual behavior early. Whitelist key Intuit email addresses to ensure legitimate Intuit messages are not being filtered into spam, and encourage everyone with access to your company’s QuickBooks and banking to stay alert for anything that does not look familiar.

Common Phishing Tactics to Watch For

Not every security threat starts with someone breaking into your account. Many begin with a convincing email, text, or phone call designed to get you to hand over access yourself.

Phishing messages often create urgency: a warning that your account has been suspended, a payment failed, suspicious activity was detected, or immediate verification is required. The goal is to override your good judgment and convince you that clicking a link and entering your credentials—or sharing a verification code over the phone—will solve your problem before it gets worse.

Be especially cautious of messages or calls that ask you to:

• Share a password or verification code

• Sign in through an unexpected link

• Confirm sensitive account or payment information

• Act immediately to avoid an account closure, payment delay, or other consequence

• Download an attachment or software you were not expecting

Caller ID and familiar branding are not enough to prove a communication is legitimate. If someone contacts you claiming to be from Intuit and asking for sensitive information, end the interaction and contact Intuit independently through a support channel you already trust.

The same rule applies to email. Rather than clicking a link in a message, navigate directly to QuickBooks or Intuit yourself and verify the issue from there. A few extra seconds of caution can prevent a convincing message from turning into unauthorized account access.

What Phishing Attempts Are Most Likely to Target

In many cases, a phishing attempt’s primary objective is to quietly reroute expected funds, such as an employee’s paycheck or a client’s invoice payment, to a fraudulent account. 

A bad actor may focus on a few especially sensitive areas:

• Merchant Services contact information: Changing the email address or phone number tied to your Merchant Services account can interfere with payment and security communications.

• Employee and payroll information: Direct-deposit details are a high-value target because changes can redirect payroll. Review both active and inactive employee records for unexpected edits.

• Vendor banking information: Altered payment details can send legitimate vendor payments to the wrong account.

• Lending activity: Unauthorized access may be used to submit a financing application using your business’s information.

Because these attacks often rely on the redirection of a legitimate payment, rather than an obviously fraudulent transaction, you should immediately verify changes to banking details, direct-deposit instructions, or account contacts. Confirm sensitive changes through a separate, trusted channel as soon as possible.

Signs Your Account May Have Been Breached

We’ve covered the common tactics phishers use and the types of information they’re after. Now, it’s time to discuss how to identify a breach and distinguish normal QuickBooks activity from something that deserves immediate attention.

A breach is not always obvious. In many cases, the first clue is a small change that seems out of place—a new user you do not recognize, an unexpected account notification, or activity in QuickBooks that no one on your team can explain.

Watch for signs like unfamiliar users in your account, changes to company contact information, edits to employee or vendor records, unexpected payment activity, or transactions you do not recognize. You may also notice unusual activity in the Audit log, including logins or changes made at times that do not align with your team’s normal activity.

Here's how to confirm each of these items:

• Unfamiliar users added to your account? Check Settings → Manage users for anyone you do not recognize. To remove an unauthorized user, select the user from the list and choose Delete or Remove user, then confirm the change. You may also receive an email notification from Intuit that a new user has been added to your account. If this happens, you'll see a link in the email that says "Delete user."

• Need to check if your account settings have changed? Navigate to Settings → Account and settings, review your company name, address, email, phone number, and payment settings. If anything has changed, correct it immediately and contact Intuit customer support right away.

• Looking for an audit trail of all recent activity? Head to Settings → Audit log. Here, you can view changes to your settings, vendors, employees, payroll, and other account activity. If you spot an unfamiliar login or user, look closely at the actions that followed—such as an employee record being edited or a new vendor being added—to determine which records need further examination. 

Your email inbox can provide another clue. If you suddenly receive a large volume of newsletters, sign-up confirmations, or other unexpected messages, do not dismiss it as ordinary spam. This tactic, sometimes called an “Inbox Bomb,” is designed to obscure important security notifications, including alerts that a new user was added to your account or that your account has been accessed from an unfamiliar device.

Investigate anything you cannot readily explain, contact Intuit immediately, and review the surrounding activity before concluding everything is clear.

What You Can Expect From Intuit if Your Account Has Been Hacked

If your QuickBooks account is compromised, Intuit can move quickly to secure access, verify your identity, and help you regain control of the account. Once you report suspicious activity, the priority is to stop further unauthorized access and determine the scope of what happened.

Intuit can help clarify what data was exposed—and what remained protected—so you have a clearer picture of who may be affected and should be notified.

Intuit may lock the account, restrict access, or require additional verification before restoring access. You may receive instructions by email outlining the recovery process, including steps such as changing your password, confirming your identity, and enabling two-factor authentication if it is not already turned on.

In some cases, identity verification may involve scanning a QR code with your phone, submitting images of a government-issued ID, or completing a live identity check. The exact process can vary, so follow the instructions provided through Intuit’s official recovery channels.

Be Ready to Act Quickly

The most important thing you can do after spotting suspicious activity is move quickly and methodically. Remove unauthorized users, review the areas of your account that may have been affected, and contact Intuit right away so they can help secure the account and guide you through recovery.

Having a trusted QuickBooks partner can make both prevention and response much easier, too. As a QuickBooks Solutions Provider and QuickBooks ProAdvisor of the Year, Account Ability Consulting can help you strengthen your account setup, review access and controls, spot potential vulnerabilities, and provide experienced guidance if something goes wrong. The goal is simple: help you stay prepared, respond confidently, and protect your business with the right support behind you.