TL;DR:

  • Cloud accounting platforms are high-value targets: they hold bank account details, payroll records, supplier payment information, and the ability to process payments
  • Account takeover via credential stuffing or phishing is the primary attack vector — multi-factor authentication prevents the vast majority of these
  • Bank account detail changes (supplier payment details) are the most financially damaging attack pattern and require a specific process control to defend against

Xero and QuickBooks are convenient, cloud-based, and deeply integrated with your banking. They’re also a single point of access to everything an attacker needs to redirect payments, extract payroll data, or impersonate your business to suppliers and clients.

Attacks against cloud accounting platforms in the UK have been rising since 2024, driven by AI-assisted phishing that personalises emails using data scraped from public sources (Companies House, LinkedIn, your own website). A convincing phishing email landing in the inbox of whoever manages your accounts is all it takes if MFA isn’t in place.

This guide covers the specific threat patterns and the specific settings that address them.

What Attackers Are After

Bank account detail manipulation. The most financially damaging pattern. An attacker who gains access to your accounting platform can:

  • Change supplier bank account details so your next payment goes to them, not your supplier
  • Add new payees to your payment list
  • Access bank feed integrations that may contain real-time account information

Payroll data. Employee names, National Insurance numbers, bank account details, and salary information — all present in cloud accounting payroll modules — are valuable for identity theft and targeted fraud.

Invoice interception and manipulation. Access to your accounting system means access to draft invoices, payment history, and customer details — useful for crafting highly convincing invoice fraud attacks against your customers.

VAT and Companies House data. Your VAT registration number, turnover, and filing history (accessible through accounting integrations) are useful for impersonation attacks.

Credential harvesting for banking integration. Accounting platforms with bank feed integrations sometimes hold credentials or OAuth tokens for your business bank accounts. These are an additional target.

The Most Common Attack Path

Most attacks start with phishing or credential stuffing — not with sophisticated exploitation of the accounting platform itself.

Phishing: An email arrives appearing to be from Xero or QuickBooks (“unusual login activity detected”, “your subscription is expiring”, “a bill requires your approval”). The link leads to a convincing fake login page. The victim enters their credentials, which are harvested.

Credential stuffing: Credentials from data breaches (there are billions of leaked email/password pairs available to attackers) are tested against accounting platform logins. If you reuse passwords from other services, this is the route in.

MFA stops both attack vectors at the login stage. This is not optional — it’s the single most important control.

Xero Security Settings

Enable two-step authentication (mandatory).

  • In Xero: Settings → Users → [your user] → Two-step authentication
  • Require it for all users, not just yourself — an attacker targeting your accounts team doesn’t need your credentials if a bookkeeper’s account is unprotected
  • Use an authenticator app (Authy, Google Authenticator) rather than SMS where possible; SIM-swap attacks can bypass SMS-based MFA

Review user roles and permissions.

  • Settings → Users
  • Apply least privilege: users who only need to see reports shouldn’t have invoice creation or payment rights
  • Remove any users who no longer work with your business — these “ghost” accounts are a common attack vector
  • Disable “advisor” access for accountants who are no longer active

Audit login activity.

  • Settings → Security → Login history
  • Check periodically for logins from unexpected locations or times

Review connected apps.

  • Settings → Connected apps
  • Remove any integrations you no longer actively use; these represent additional attack surface and data access grants

QuickBooks Security Settings

Enable multi-factor authentication.

  • Account settings → Sign-in & security → Two-step verification
  • As with Xero, enforce this for all team members, not just the primary account holder

Review user permissions.

  • Settings → Manage users
  • QuickBooks’ user roles (administrator, standard user, custom) should reflect actual job requirements; most users don’t need admin access

Check connected apps and bank connections.

  • Settings → Apps → Connected apps
  • Review which third-party applications have access; remove those that are unused or no longer required

Monitor audit log.

  • Reports → Audit Log
  • Review for unexpected activity: changes to supplier bank details, new users added, unusual report access

The Bank Detail Change Control

This is the most important process control that software settings alone cannot provide.

When a supplier emails to say their bank details have changed, the natural response is to update the details in your accounting platform. Attackers know this — “supplier bank detail change” is the template for many invoice fraud attacks, because it triggers a payment to the attacker’s account on the next legitimate invoice.

The process that prevents this:

  1. Any bank detail change request, regardless of how it arrives, triggers a verification call
  2. The call goes to a number you already have for that supplier (from previous correspondence or their website)
  3. Not to a number included in the email requesting the change
  4. The change is only made after verbal confirmation

This should be a written policy in your accounts process — not informal guidance. It applies even when the email looks perfectly legitimate and references real invoice numbers and project details.

Protecting Your Accounting Login Credentials

Use a unique, strong password for your accounting platform. Not reused from any other service. A password manager (1Password, Bitwarden) makes this manageable.

Use your work email address, not a personal one. Accounting platforms linked to personal Gmail accounts are more vulnerable; if your personal email is compromised, your accounting access may follow.

Be suspicious of any email asking you to click a link to log in. Go directly to the accounting platform URL rather than clicking any link. Bookmark the actual login page.

If You Think Your Account Has Been Compromised

  1. Change your password immediately, using a device you’re confident is uncompromised
  2. Check the audit log for what the attacker accessed or changed
  3. Check supplier bank details — restore any that were changed
  4. Notify your bank if you have bank feed integrations connected; they can flag unusual activity
  5. Check for new users added to your account
  6. Report to Action Fraud (actionfraud.police.uk) — UK business fraud incidents should be logged

The time between account compromise and a fraudulent payment can be short — attackers often act quickly. If you suspect compromise, treat it as urgent.

The Bigger Picture

Cloud accounting platforms make bookkeeping genuinely easier for small businesses, and the benefits are real. The security overhead is modest: MFA for all users, regular user permission review, and a verified-callback process for any bank detail change. None of this is technically complex; it’s mostly about making sure the process is consistent rather than depending on individuals to remember to verify.

Given that a single fraudulent payment redirected to an attacker’s account can run to tens of thousands of pounds, the hour spent setting up MFA and reviewing permissions is one of the best returns on time available to any UK small business.