Locked Out of QuickBooks by Your Bookkeeper? Steps to Take Now
A reported theft case ended with the owner locked out of QuickBooks. Here is how admin access gets lost, what to do first, and how to stay in control.
Recent news reports described a bookkeeper who spent an employer’s money on vacations, car payments and medical procedures. The owner discovered it late, and then found a second problem waiting: no access to the company’s own books. The theft was the loss. The lockout was the blindfold. This guide covers how that happens, what to do first, and how to keep it from happening to you.
How does an owner lose access to their own books?
QuickBooks Online treats access as an account question, not a property question. Whoever controls the subscription’s top administrator seat can invite users, change roles and remove people. A bookkeeper sitting in that seat can simply take you out. Shared logins make it easier still. When someone signs in as you, from their device, with your multi-factor codes, the software has no way to tell you apart.
Lockouts like this are not faults in the program. The keys changed hands, and you did not notice when.
Desktop company files fail differently. The file lives on a computer or server, so a departing bookkeeper can take it along, or leave it behind a password nobody will share. A locked or damaged company file is a file-level problem we handle in our own name, separate from any cloud account: see our QuickBooks error code repair service.
The spending hides inside ordinary transactions
Embezzlement rarely looks dramatic on the screen. Personal travel posts as conference costs. Car payments become vehicle expenses. Medical bills slip in as supplies or owner draws. Watch for vendors you cannot match to a contract, recurring charges you did not approve, and edits to closed periods.
Behavior matters too. A bookkeeper who refuses time off, resists review, or insists on being the only one with bank access is telling you something. So are statements and bank alerts routed to an address you do not check.
First moves when you discover it
Secure the money before the software. Call your bank, freeze cards and transfers, and revoke any payment permissions and bank feed credentials the bookkeeper controls. Ledger cleanup can wait; the accounts cannot.
Then preserve evidence. Export or print the audit log, which records who changed what and when, including changes to users. Avoid editing anything yourself. Hand the records to a forensic accountant and your attorney, and report the matter where you would report any theft.
Account access is the one piece you cannot fix yourself. Only Intuit can verify a subscription owner and restore a QuickBooks Online sign-in or admin seat, so that recovery runs through their channels and their identity checks. Plan for it to take longer than a normal password reset.
Who should hold the admin seat?
You do. An owner should hold the primary administrator seat personally and keep the recovery email and phone under their own control. Give the bookkeeper a named user login with the narrowest rights the job allows, and never share your sign-in with anyone. Remove access the same day someone leaves, whether they resign or are dismissed.
Review the user list quarterly; it takes a minute and answers the only question that matters, which is who can open the books today.
A monthly habit that catches this early
Set a recurring reminder to read the audit log, scan for unfamiliar users and vendors, and look at anything edited after the month closed. Reconcile the bank accounts yourself, or have someone independent of the bookkeeper do it. The point is not suspicion for its own sake. Separated duties are the control that fraud has always had the hardest time crossing.
Start today: sign in, open the user list, and confirm every name on it still works for you and holds only the rights the job needs. If the sign-in fails, that failure is your first finding, and the sections above are your route back.