QuickBooks Users Hit Snags Locking Intuit Accounts After Suspicious Activity
Readers locking an Intuit account after suspicious activity are surprised to find only the signed-in user is deactivated, and reactivation takes effort.
The questions arrive with a similar shape. A QuickBooks user spots something odd in an account, hunts down the security settings behind the sign-in, and freezes at the deactivation option. What exactly gets locked, and can it be undone? The short answers, drawn from the settings themselves, are: only the user who is signed in, and yes, but only through a reactivation process.
Finding the settings is easy. What they actually do, and how far the deactivation option reaches, is where the community threads go in circles.
Where the controls live
To reach them, sign in to the Intuit account behind your QuickBooks login. The security options sit under Sign in & security. The record of recent sign-ins sits under Account activity, and that page is the right first stop. It shows what has been happening in the account, so you can judge whether anything genuinely looks wrong before you reach for the lock.
An authenticator app beats a text code
The settings make one recommendation worth acting on: replace password-only or SMS-based sign-in with an authenticator app. The logic is straightforward. Authenticator codes change every few seconds, so a code intercepted from a text message expires before an attacker can use it. The app also generates codes with no internet connection required, which helps in spots with poor signal. One app can hold codes for several accounts at once, so a bookkeeper with a personal Intuit account and a practice account can secure both from a single phone.
Text messages have a known weakness of their own. Control of a phone number can be hijacked, and any code sent to that number follows it.
Does a lock shut down the whole account?
No, and this is the point where expectations break. The Deactivate your account link on the Account activity page deactivates the user who is currently signed in, nothing more. On a subscription with several users, locking your own sign-in leaves every other user’s access untouched. Removing multiple users means repeating the process for each one, signed in as each in turn.
A warning appears before the lock is applied: once the account is locked, signing back in requires a reactivation, or unlocking, process. Treat that as a one-way door with a toll booth. If you lock in haste and then need the account for month-end, you will spend that evening recovering access instead of closing the books. Recovery runs through identity checks rather than a quick password reset, so expect it to take longer than an ordinary sign-in.
The identity check at the end
Deactivation finishes with a verification step. A government-issued ID is requested, supplied by scanning a QR code shown on screen. The check exists to confirm that the person requesting the lock is the account holder rather than an intruder locking the rightful owner out. Once the ID clears, a message confirms the request has been processed and the session signs out. If verification does not clear, you are returned to the Account activity page to try again.
When does a lock make sense?
The activity page gives you the evidence. A sign-in from a device or location you cannot explain, security notices you never triggered, or a recovery attempt you did not start all justify a closer look. A forgotten password, by contrast, is a recovery problem, not a reason to deactivate. Locking is the strong step. It removes your own access until reactivation is complete, so it fits a genuine suspicion that someone else is inside, not routine housekeeping.
The details that do the quiet work
Less flashy settings deserve as much attention as the lock. The user ID, email address, and phone number on the account all live here, and security and account notices go to the email and phone on file. Both are also what you need to recover an account when a password goes missing. A number left behind with an old carrier is a recovery path handed to a stranger, which is a bigger exposure than most people realize.
The page is worth a visit whenever your personal details change, not only when something goes wrong.
Our read
The settings are not the problem; the surprise is. Readers who assume a lock is account-wide, or reversible with a password reset, are the ones who end up stranded. The sequence that avoids the mess is short: check the activity page first, refresh your contact details, and only then decide whether the threat justifies a lock. Look before you lock, and know which user you are locking.