A changed vendor bank account, duplicate invoice or unexplained adjustment deserves verification. It does not establish fraud. The same record can result from an error, a legitimate business arrangement or deliberate misconduct; supporting evidence and context determine the next step.
This article is part of our guide to QuickBooks cleanup and bookkeeping controls.
A useful review separates two situations: an urgent risk to funds or systems, and a routine bookkeeping discrepancy. Handle the urgent risk immediately, while preserving the records needed for an independent review.
If funds were sent or an account is compromised
Contact the financial institution immediately through a trusted channel and ask about stopping, recalling or recovering the payment. Give it the transaction identifiers and destination details it requests. For business email compromise, the FBI also directs victims to report through its Internet Crime Complaint Center. Do not wait for a preparer, vendor or accountant to finish an ordinary review. Recovery is not guaranteed. See the FBI’s business email compromise guidance.
Activate the business’s authorized incident-response team. Preserve messages, payment instructions, logs and relevant devices while qualified personnel contain the compromise. Involve counsel to assess reporting and notification duties, and check applicable insurer notice requirements promptly. Do not delete suspicious records or conduct an improvised cleanup that destroys evidence. The FTC’s breach-response guide explains the roles of forensic specialists, legal counsel, containment and evidence preservation.
If payment is still pending, refer it to the authorized approver for a hold or other appropriate control while the request is verified. Confirm changed payment instructions through a known contact method obtained independently of the disputed message. An email reply to the same compromised account is not independent confirmation.
Use warning signs as questions to investigate
Review the transaction’s business purpose, supporting documents, approval and actual recipient. Patterns can help prioritize work, but a round number, weekend entry or unfamiliar trading name is not evidence of intent by itself. Missing documentation also requires investigation before deciding whether the cause was poor recordkeeping or misconduct.
| Observation | Context to consider | Verification |
|---|---|---|
| New bank instructions or an unfamiliar payee name | A genuine account change, trading name or documented factoring arrangement may explain it; redirection is also possible. | Independently confirm the supplier’s authority and approved payment destination before release. |
| Similar vendor profiles or invoice numbers | Duplicate setup or a corrected invoice can resemble duplicate billing. | Trace each record to the original invoice, any credit or replacement, receipt of goods or services and payments already made. |
| Several invoices in one payment cycle | Separate deliveries or recurring work may legitimately be paid together. | Compare the underlying obligations; check whether the same work was billed or paid twice. |
| Whole-dollar or vague invoices | A fixed monthly fee may be exactly $5,000; that amount alone proves nothing. | Compare the contract, scope, work performed and authorized price. Request missing detail. |
| Repeated amounts just below an approval limit | Separate purchases may be valid, while splitting one purchase can evade policy. | Aggregate related invoices and compare dates, orders and the policy’s definition of a purchase. |
| Off-hours entries or approvals | Remote work, time zones or automated processing may explain timing. | Compare entry, approval and bank dates and determine whether a human or automated process generated the record. |
| Vendor details overlap with employee information | A shared address or disclosed related-party relationship may have a legitimate explanation. | An authorized, restricted reviewer should check identity, disclosures, approval and actual delivery without circulating personal data. |
| Unexplained credits, write-offs or reconciliation entries | Returns, settlement corrections or ordinary errors may explain changes. | Trace to the original transaction, approval and independent evidence; investigate unsupported adjustments. |
Vendor checks, invoice matching and separation of duties are standard internal-control practices; tailor them to the business. A two-contact policy or business-registration check is not a universal legal requirement for every supplier, and tax-document requests depend on the payee and payment.
See “Expense Reimbursement Fraud: Approval and Documentation Controls” for more on Expense Reimbursement Fraud.
Trace the payment without altering the evidence
For a routine exception with no active compromise, an authorized reviewer can begin with the payment record and follow it through the linked bill, vendor profile, contract or purchase order, delivery evidence, approval and bank record. Confirm amounts, dates, payee and account coding. Keep a dated note of what was checked, what remains unresolved and who owns the next step.
Obtain statements and payment details directly from the financial institution through authorized access, instead of relying solely on copies supplied by the person being reviewed. An independently obtained statement can confirm the cash movement; it does not alone establish that the purchase was genuine. Compare it with source documents and contractual obligations.
For example, if two $2,400 payments relate to one $2,400 obligation, the cash outflow is $4,800. That does not establish $4,800 of legitimate expense. Determine whether the second payment was a duplicate, a valid separate purchase, a recoverable overpayment or a loss before deciding the accounting treatment. A promised refund is not cash received.
Do not start by asking a potentially implicated preparer to resolve the concern. When misconduct is plausible, route the matter to an independent authorized reviewer and counsel as appropriate. Keep fact gathering proportionate and avoid accusations based on a software flag.
A correct reconciliation may need no adjusting entry
A reconciliation explains the relationship between ledger cash and the bank statement at a specified date. Properly recorded outstanding checks and deposits in transit can be legitimate reconciling items without requiring new journal entries. If all transactions already agree, no adjustment may be necessary. A zero difference is an expected result, as Intuit’s reconciliation guidance explains.
Investigate unsupported balancing entries, omitted statement transactions, unexplained changes to reconciled items and old outstanding items that no longer have a clear explanation. Do not create a journal entry merely to make the reconciliation appear active or force the difference to zero. Likewise, do not erase a valid outstanding payment just because it has not cleared.
A perfectly balanced reconciliation does not prove that every payment was authorized. A fraudulent payment can appear correctly in both the bank statement and ledger. Authorization, supporting work and the recipient require their own review.
Know what the QuickBooks Online audit log shows
QuickBooks Online’s Audit log requires admin access and records activities including transaction and vendor edits. Intuit currently states that events are available for two years. Filter the relevant user, date and event, then inspect the transaction history. System Administration and other system profiles can reflect automated activity, connected apps or changes caused by another transaction. The displayed user or timestamp alone does not prove a person’s intent. See Intuit’s Audit log documentation.
These instructions concern QuickBooks Online; Desktop has different reports and access arrangements. Preserve relevant history promptly with original invoices, emails, approvals, bank records and verification notes in a controlled location separate from the working accounting file. Record where each item came from and who collected it. A software log is one evidence source, not a permanent archive or a substitute for source records.
Test permissions instead of relying on role names
Intuit limits the documented bill-payment roles and workflows to applicable QuickBooks Online Advanced or Bill Pay Elite arrangements. Its Bill clerk role can add bills and add or edit vendors; the Bill payer role can pay bills and edit vendor details. Assigning those role names therefore does not automatically separate vendor changes from payment release.
Intuit also warns that downgrading from Bill Pay Elite without an Advanced subscription removes relevant permissions and approval workflows, allowing pending bills to be paid without approval. Review the current plan and test effective access before relying on controls, and reassess after subscription or integration changes. See Intuit’s bill-payment roles and permissions.
Document who can request a vendor change, enter it, approve it, approve an invoice, release money and reconcile the account. Test whether a user can change the destination after approval or bypass a workflow through another payment channel. Use independent bank-change verification and payment approval, including bank-level controls where available. Small teams may need direct owner review as a compensating control. No control guarantees prevention, particularly where privileged access or collusion is involved.
Make the review part of normal operations
- At vendor setup or change: establish the supplier’s identity and business purpose, collect applicable tax documentation, verify payment instructions independently and retain approval. Restrict access to tax IDs, bank details and employee records.
- Before payment: match the bill to the agreement and evidence of delivery or service. Check prior payments and credits. Escalate unusual requests and policy exceptions to an independent approver.
- At month-end: reconcile bank and credit-card accounts, review new vendors and changed payment details, and examine selected payment support and unresolved exceptions. Obtain statements independently.
- After staff, software or plan changes: reassess access and approval paths and verify that the intended separation still works.
Use a single exception register with the transaction, concern, evidence, reviewer, action and resolution. Review frequency should reflect payment volume and exposure. A missed review increases the need to catch up; no fixed six-month gap makes all records inherently unverifiable.
Define the investigation and correction work separately
Bookkeeping cleanup can address duplicates, coding and reconciliations. A forensic investigation has a different purpose and may require specialists, preservation procedures and legal coordination. A CPA credential or routine tax engagement alone does not establish forensic expertise or authorize an investigation. Agree on independence, records, permitted access, deliverables, reporting responsibilities and payment authority before work begins.
Once the facts are sufficiently established, document and approve necessary accounting corrections while retaining the original history and support. Determine whether filed income, payroll, sales-tax or information returns need correction. Entity-level and owner-level consequences should be reviewed separately where applicable; a ledger adjustment does not automatically correct a filed return.
Do not assume every suspicious payment creates an immediately deductible theft loss. The tax analysis considers whether theft occurred under applicable law, the amount and basis, discovery timing and any reasonable prospect of reimbursement. Business and personal losses have different rules. Keep recovery and insurance records with the tax analysis, and avoid deducting the same loss twice. See IRS Publication 547.
For accounting service inquiries, use CPA Firm South Florida’s services page to discuss the records and scope involved. An urgent transfer or active compromise should follow the immediate-response steps above.
Frequently asked questions
What should I do if a suspicious payment has already been sent?
Contact the financial institution immediately about stopping or recovering the payment. For business email compromise, also report to FBI IC3. Activate authorized incident response and preserve evidence; do not wait for the normal bookkeeping review.
Does a balanced reconciliation prove the payments were legitimate?
No. A zero reconciliation difference is expected when records agree, but it does not establish authorization or business purpose. Check payment support and investigate unsupported entries separately.
Can QuickBooks roles prevent one person from changing and paying a vendor?
Do not assume they do. Intuit states that the Bill payer role can edit vendor details. Check the actual subscription and permissions, and independently verify payment-detail changes and payment release.
Who should review suspected misconduct?
Use an authorized reviewer independent of the people and transactions in question. Plausible misconduct may require a separately scoped forensic engagement, legal counsel or incident-response specialists; routine bookkeeping and tax preparation do not establish that scope.