Unauthorized Bill Pay Checks Initiated by a Group Login OH-NO!

While the experience may not be bill pay checks, there are those organizations that knowingly chose to or unknowingly have opened themselves up to fraud by having group logins to their accounting system and financial institutions. And it is often at the worst time that organizations come to realize that unique logins for each user is a must!

A username is a form of identification, used to build a unique digital profile about a specific user. This digital profile protects both the organization and the user. While a specific user’s password is their authentication. A password protects the user’s identity because it verifies that they are who they say they are. 

Who of the current employees using a group login initiated those unauthorized bill pay checks that totaled over $20K? For that matter, which of the past employees that had access to that group login when they worked for the organization may have initiated them? There is no way to tell, so what do you do, fire everyone, switch banks, and do it all yourself? Not a chance! You need your sanity and your good employees!

So what can you do today that aids in security, accountability, and efficiency? 

Candance Weaver Bookkeeping absolutely recommends that you create a unique login for each user accessing your organization’s computers, accounting software, online banking, online credit cards, etc. Using the same credentials for multiple users is a really bad idea. Don’t do it!

Keep your sanity, and your good employees safe, while deterring nefarious employees:
1) Get rid of all group logins, and put in place a unique login for each employee for accounting systems, banking institutions, etc.
2) remind employees that all systems have an action log
3) have open, adult conversations with employees when things don't seem to make sense (ask questions - don't accuse)
4) Save logs and add them to any other documentation that might be needed if the organization needs to take action against a nefarious employee.  

​Protect your good employees and your organization - Be proactive! 

Using the same credentials for multiple users is a really bad idea. Don’t do it! 

Candance Weaver Bookkeeping absolutely recommends that you create a unique login for each user accessing your organization’s computers, accounting software, online banking, online credit cards, etc. Here are some of the main reasons why: 
​
Security

• Your computers, software, bank accounts, etc..  contain critical and sensitive business data, that you may not want to give the same access to for all users. Each user must use their own unique username and password to sign in.
  • NEVER use another user’s logon credentials, it opens you personally up to being held accountable for someone else's actions. 
• Using unique users, roles and permissions allows you to limit a user’s access to certain data and to control what actions they can take.
  • For instance, you could have a salesperson enter a quote into an accounting system, and at the same time not allow them to see payroll data.
• Should a user no longer work for your company, you remove this user immediately so they can no longer access sensitive information or delete important data from your organization’s systems.
  • If you use a group login, you will have to change all your passwords, across all systems every time someone leaves the organization, instead of removing one user. 
  • Sharing usernames and passwords is such a bad idea.
• When everyone signs in with their own account, they can all use two-step verification, protecting your organization's data even more.

Accountability

• Actions taken on your computers, software, online banking, etc. are logged (e.g. which user has edited or deleted a transaction in an accounting system, who has initiated a bill pay check in your online banking, who moved a file off the server, etc.).
  • These actions can be tracked and help prevent the misuse of data, especially in the case of accounting and banking.
  • The log of actions taken can help prevent fraud. 
• If fraud occurs, the log that shows unique user logins can be used to take the appropriate action against an nefarious employee.
  • Everyone using the same login and password, actually opens an organization up to fraud, allowing the nefarious employee to hide amidst all the other employees that use that group login and password. 
• The account or user administrator decides which rights, roles and permissions they assign to each user. 

Efficiency

• Using unique logins for each user will enable tech support to provide faster and proper support.
  • If there is an issue with a particular software, that support team contacts the user working in that software.
  • A lot of time can be lost trying to find the right person if you don’t work with unique user logins.
• Many systems send a number of automatic emails depending on user actions.
  • For instance, accounting systems may send out a daily or weekly report.
  • If users share an email address, they will all get, read and deal with emails not meant for them, which is not efficient.
  • Even when they are working in the system, data not pertinent for them will only distract them.
    • For instance, payroll data is only pertinent to those employees that are responsible for running the payroll, while it becomes a distraction and possibly a company wide issue when opened to everyone on that group login. 
• All users receive product updates.
  • That way, all users keep track of new features that they have access to, keeping everyone abreast of updates at the same time.
  • This saves employees critical time in their day to day email management.

If you are an organization leader who is looking for a bookkeeper who promotes and practices basic digital security contact me! cmweaver [at] cwbookkeepingservice [dot] com or 865-951-7407. 
 

​