QuickBooks Account Hacked: First Steps and How to Recover

Losing access to your own books is disorienting, and it rarely happens at a convenient moment. Most QuickBooks account takeovers begin with a phishing email or a password reused from another site that was breached. The intruder typically moves within hours, so what you do first matters more than how it happened. Here is the order we recommend.

Signs someone else is in your account

Any one of these is reason to act, even if the books still look normal:

• You are locked out even though the password is correct.
• Password reset emails arrive that nobody on your team requested.
• The user list contains people you did not add.
• The recovery email or phone number on the Intuit account has changed.
• Invoices, payments, or journal entries appear that you did not create.

Secure the email account first

Intruders often take the mailbox before they touch the books. Email is where reset codes and security alerts land, so whoever controls it controls every reset you attempt. If your mail has been compromised too, change that password first, from a device you trust. Then sign out all other sessions so the intruder is dropped immediately.

Take the account back

With email secured, reset your QuickBooks password and sign in. Check the recovery email and phone number right away, and change anything the intruder altered. Turn on two-step verification if it is not already active, so a stolen password alone cannot get anyone back in. If the recovery details were changed and you cannot get in, use Intuit’s account recovery process to prove ownership.

Find out what was changed

QuickBooks Online keeps an Audit Log showing who did what and when. Work through it from the earliest unfamiliar entry. Remove any user you did not add, and pay close attention to three places: bank details on vendor records, payroll settings, and linked bank feeds. A changed vendor bank account is a classic sign of payment diversion fraud, where your money is rerouted to the attacker.

Contain the financial damage

Call your bank about any transfer you cannot explain, and review recent payments to vendors. If fake invoices went out to your customers, warn them before they pay. Keep a copy of the Audit Log. It documents the timeline, and banks and insurers will want it.

Check the device and your other logins

Malware on a familiar computer can capture every password you type. Run a full scan, ideally from a second clean machine, before you consider the account safe. Then change any other account that shared the same password. Reused credentials are how one breach becomes five.

If the data itself looks wrong

Sometimes the damage goes past access. A file that will not open, balances that refuse to reconcile, or stretches of missing transactions can all follow an intrusion. Our QuickBooks file repair service can assess the damage and recover the data so your books stay usable.

Making the next takeover harder

Two-step verification, a unique password, and a healthy suspicion of unexpected invoice attachments stop most takeovers before they start. Review your user list each quarter, and check that the recovery details on your Intuit account are still yours. If you have been through an intrusion and something in the file still does not add up, our QuickBooks data recovery service can examine it and tell you exactly what is recoverable.