Is Read-Only Bank Access Safe for Accounting Firms? The Hidden Danger

Is "read-only" access really read-only?

Many small business and personal bank accounts have no true read-only role. When a client says "I gave you read-only access," it often means one of three things:

• The client shared their own username and password. Your staff now hold the keys to move money, not just view it.
• The client added a sub-user with limited rights. Permissions vary by bank, are rarely reviewed, and can be widened later without anyone noticing.
• A staff member saved the login in a browser or spreadsheet. The access outlives the engagement, the employee, or both. In each case, the firm can't prove what the employee could or couldn't do.

What are the operational risks of shared bank logins?

• Credentials spread into emails, password sheets and saved browser profiles.
• MFA breaks the workflow. Staff text clients for one-time codes every month, training clients to hand codes to anyone who asks, the exact habit phishers exploit.
• Turnover leaves doors open. Few firms make every client change passwords when an employee leaves.
• No audit trail. Activity shows as the client's own login, so no one can prove who did what. Security guidance from banks and Canada's Centre for Cyber Security identifies shared logins as a primary path to unauthorized account access.
• It doesn't scale. Logging into hundreds of client banks every month is hours of manual work.

Who is liable if money goes missing?

Often the client, and then the firm. Under Regulation E's official interpretation, if a consumer gives someone an access device and that person exceeds their authority, the consumer is liable for those transfers until they tell the bank the person is no longer authorized. Most operating accounts are business accounts, which generally fall outside Regulation E, so protections are weaker still, and bank fraud protections may not apply when credentials were shared. The risk is real: the Association for Financial Professionals found 79% of organizations were targets of attempted or actual payments fraud in 2024, and bookkeeper embezzlement cases show how master logins let funds move without approval. The client will look to the firm to make them whole, so ask your E&O carrier in writing whether losses tied to staff holding client bank credentials are covered.

How does it affect your compliance program?

If your firm prepares tax returns, the FTC Safeguards Rule treats you as a financial institution, as the IRS states in its guidance to tax professionals. The amended rule's requirements, including multi-factor authentication, access controls and a written information security plan (WISP), took full effect on June 9, 2023. Shared bank logins collide with access controls, defeat MFA, and make logging and incident response impossible. If your WISP is silent on client bank credentials, it has a gap.

What is the safer alternative?

Separate getting the data from holding the keys. Bank-data aggregators such as Mastercard Open Finance (Finicity) and MX let the client connect their bank once in a secure flow and authorize data sharing. Your staff never see a password, can't move money, have nothing to revoke when they leave, and statements and check images arrive automatically. Bankrate notes that accounting software integrated with the bank gives access to key financial data without needing login credentials.

How do you remove shared bank logins from your firm?

1. Inventory every client bank login your staff hold and where each is stored.
2. Delete credentials from spreadsheets, emails and shared browser profiles.
3. Ask clients to change passwords on any account a former employee could reach.
4. Move each client to a secure aggregator connection instead of a shared login.
5. Update your WISP to state that staff do not hold client bank credentials.
6. Ask your E&O carrier how it treats losses tied to staff bank access.

How LedgerSync helps

Clients connect their banks once through Mastercard Open Finance or MX, and your staff never see a password. LedgerSync fetches bank statements from more than 5,000 banks and check images from hundreds, and syncs to QuickBooks Online, QuickBooks Desktop, Thomson Reuters Accounting CS and Zoho Books. You get the statements you need, without the keys you don't want.

Frequently asked questions

Is read-only bank access safe for bookkeepers? Often not. Most "read-only" setups rely on the client's real login or loosely controlled sub-users, with no audit trail. Who is liable if an employee misuses a client's bank login? Usually the client first, because sharing credentials can make transfers count as authorized, and the client will then look to the firm. Does the FTC Safeguards Rule apply to accounting firms? It applies to tax preparers and many firms handling customer financial information, requiring MFA, access controls and a written security plan. Does Regulation E protect business bank accounts? Generally no. Regulation E covers consumer accounts, so business accounts have weaker protections. What is the safest way to get client bank statements? A secure aggregator connection where the client authorizes data sharing and the firm never holds a password.

This article is general information, not legal advice.

Sources

• IRS Office of Professional Responsibility: Careful WISP(er)
• CPA Practice Advisor: What the FTC Safeguards Rule actually requires from tax and accounting firms
• Shazam: Reg E and unauthorized EFT claims
• Relay: How to give your accountant secure bank access (AFP 2025 fraud survey)
• Relay: Should your bookkeeper have access to your bank account?
• Bankrate: Who should have access to your business finance accounts?
• Numetix: A bookkeeper stole $1.48 million, 7 financial controls to check
• Quail Creek Bank: The hidden risk of shared logins and passwords
• AccTax: Bookkeeper bank access, 7 view-only rules (citing Canadian Centre for Cyber Security)
• 3n1 IT: Why shared logins are a security risk for your business
• QuickBooks Community: Sharing access is a EULA violation; add users instead