Quick Answer
Virtual bookkeeping is safe when the access is set up correctly, and correct isn’t complicated: your bookkeeper gets read-only bank access instead of your bank login, you keep the Primary Admin role on your own accounting file, multi-factor authentication is on everywhere that touches your money, and documents move through a secure portal rather than email. A professional firm already works this way and won’t blink when you ask. If a bookkeeper wants your bank username and password, that’s a problem with that bookkeeper — not with virtual bookkeeping.
The discovery call went well. You liked them. You’re ready.
Then the onboarding email lands, and buried in a friendly list of housekeeping items is a line that stops you cold: bank login and password.
So you sit there with your cursor in the reply box, feeling faintly ridiculous. This is a professional. They came recommended. Everybody does this, right? But you’ve never typed your bank password into an email to someone you met on Zoom three weeks ago, and something about it feels wrong.
Trust that feeling. It’s correct.
You shouldn’t have to choose between getting help with your books and keeping control of your money. Every control below exists so you can have both, and most take one email to arrange.
They Don’t Need Your Bank Login
Your bookkeeper does not need your banking username and password. Not to categorize, not to reconcile, not to close your month. What they need is the data — transactions, balances, statements — and that’s available through channels built to deliver it without handing over the account.
The best argument against sharing isn’t even about trust. A shared password can’t be revoked without changing it for everyone, leaves no record of who did what, and usually breaks your bank’s terms of service. If something goes wrong — even something innocent, like a duplicated transfer — there’s no way to establish who was logged in. Shared credentials don’t just create risk. They destroy your ability to answer questions later.
So the easiest item comes first: don’t send it. If a firm pushes back, you’ve learned something useful for free.
Read-Only Bank Access Is a Product Feature, Not a Favor
Nearly every major US business bank offers read-only user access as a standard entitlement. You add your bookkeeper as a user with view rights to the accounts they need. They see transactions and pull statements. They cannot move money, add payees, or change anything.
I’m deliberately not publishing click-by-click instructions, because bank menus get redesigned constantly and stale directions are worse than none. Message your banker and ask: “I need to add a view-only user to these accounts — what’s the process?” They field that every week.
While you’re in there, set statement delivery so statements come to you. If they’ve been routing to your bookkeeper’s inbox, you’ve given up your only independent source of truth about your own money.
Read-only is how my own firm works with every client. I’ve never needed more.
You Keep Primary Admin on Your Accounting File
This is the item most owners get backwards, and the most consequential one on the list.
Somebody holds the Primary Admin role on your QuickBooks Online file, and it’s very common for that to be the bookkeeper — they knew the software and did the setup. Which leaves the owner as a guest inside their own financial records.
Here’s why it matters. QuickBooks Online keeps an audit log of all account activity, not just transactions: sign-ins, settings changes, edits to customers and vendors, payroll submissions. Deleted transactions stay discoverable in it. In Intuit’s own words, “for audit and security reasons, you can’t turn off the audit log.”
But viewing it requires admin access. If your bookkeeper holds that role and you don’t, the record of everything happening in your books is visible to them and not to you. Backwards. (Events are retained for two years, then age out — so open it occasionally rather than saving it for an emergency.)
Fixing this isn’t a confrontation. It’s housekeeping. “I’m tidying up our software access — can you transfer Primary Admin to me?” Any professional says yes immediately. I hold admin on exactly zero client files, and I prefer it that way. Nobody ever has to wonder.
Multi-Factor Authentication on Everything
Turn on MFA at your bank, accounting software, payroll, merchant processors, document portal, and the email account all of those send password resets to. That last one gets skipped, and it’s the one that undoes all the others.
Ask whether MFA is enforced on your bookkeeper’s side too. IRS Publication 4557, the government’s benchmark for handling taxpayer data, requires it for anyone accessing customer information, plus encryption, access controls, and a written security plan.
An honest caveat: Pub 4557 and the FTC Safeguards Rule are directed at tax return preparers. If your bookkeeper also prepares your returns, it applies to them legally. If they only keep your books, whether they’re covered is genuinely unsettled — but it’s still the right benchmark, and a firm that can describe its security plan without stalling is telling you something useful.
A Secure Portal, Not Email Attachments
Bank statements, payroll registers, and tax documents shouldn’t travel as email attachments. Email is stored indefinitely in several places, forwarded by accident, and searchable by anyone who gets into either mailbox. Any firm doing this properly has a portal or encrypted file sharing, and using it should be about as easy as attaching a file. If the answer to “how should I send this?” is “just email it,” that tells you something about how the rest of the operation runs.
The Engagement Letter Clauses Nobody Includes
This is the part that surprised me when I went looking.
The published guidance on writing engagement letters — including the AICPA-side recommendations in the Journal of Accountancy — covers scope, responsibilities, deliverables, fees, timing, and business terms. Sensible stuff. It does not address data ownership, who holds system access rights, or what happens to your data and credentials when the engagement ends.
The standard engagement letter protects the firm’s liability. It doesn’t protect your data. That gap is how owners end up locked out of their own books during a transition — usually not because anyone acted in bad faith, but because nobody wrote it down.
Add three clauses before you sign.
Who owns the accounting file — your subscription, billed to you, with your bookkeeper as an invited user. Who holds administrative rights — you do, in writing. What happens on termination — what gets returned, in what format, on what timeline, and confirmation that credentials and access are surrendered.
These are in my own client agreements. Not because I expect anything to go wrong, but because the version of me a client hires shouldn’t be the only thing standing between them and their records.
Ask Where the Work Is Actually Performed
This isn’t a gotcha, and it isn’t about offshoring being bad. Plenty of excellent firms use offshore teams; plenty of terrible ones are entirely domestic. It’s about knowing.
Ask directly: who specifically will have access to my accounts, is any of the work subcontracted or performed outside the US, and are those people bound by the same confidentiality terms you are? Pub 4557 requires vendor safeguards to be flowed down contractually — a firm’s security promises are worth nothing if the person actually touching your file isn’t bound by them. A good firm answers in a paragraph without getting defensive.
E&O Insurance and a Fidelity Bond Are Two Different Things
Almost nobody knows to ask this, and it’s the sharpest question on the list.
Professional liability insurance, or E&O, covers mistakes — bookkeeping errors, missed deadlines, negligence. Insureon reports a median around $42 a month for finance and accounting businesses.
A fidelity bond covers theft. A first-party bond protects the firm from its own employees; a third-party bond — sometimes sold as a business service bond — protects the firm’s clients from dishonest acts by the firm’s people. Median around $38 a month.
Both products exist because dishonest and criminal acts are typically excluded from E&O policies. That’s the norm, but policy language varies, so ask the firm’s carrier to confirm specifics in writing.
So: do you carry both, and does the bond cover clients or just the firm? Neither is required by law and neither is universal. Ask for the certificates — a firm that carries them is glad to send them.
What Vetting Can’t Do
There’s a comforting idea that safety comes from vetting hard enough up front — references, credentials, a good feeling on the call. Do all of that. It just isn’t the control you think it is. In the Association of Certified Fraud Examiners’ 2026 Report to the Nations, 64% of victim organizations had run a background check on the person who later defrauded them, and 88% of those checks came back clean.
That’s an argument for structure, not suspicion. Structure works identically on the honest bookkeeper and the dishonest one, which is exactly what makes it fair to both.
When More Access Actually Makes Sense
Now the honest counter-case, because a checklist that pretends every business fits it isn’t much use.
Some arrangements legitimately need more than view-only. If you’ve hired your bookkeeper to run bill pay, process payroll, or chase collections, they have to be able to initiate transactions. Refusing that defeats the point of buying the service.
The answer isn’t to withhold access. It’s to compensate for it. Keep approval authority with you so payments queue for your release. Ask your bank about positive pay if checks are involved — the bank matches presented checks against an issue file you upload, and mismatches become exceptions someone has to clear. Critical design point: it only works as a control if you clear the exception queue, not your bookkeeper.
And I’ll go further, against my own interest. The most common way a bookkeeping relationship costs you money isn’t theft. It’s ordinary error and drift — miscategorized transactions, reconciliations falling behind, reports nobody reads. If fear of handing over access keeps you doing your own books badly for another two years, that fear will have cost you more than the risk it was protecting you from.
Set it up right, then get the help.
The 10-Minute Setup: What to Change Today
None of these require a conversation with anyone you’re nervous about.
- Check who holds Primary Admin. If it isn’t you, send the housekeeping email today.
- Turn on MFA at your bank, accounting software, payroll, merchant processors, and the email address they all send resets to.
- Ask your banker about view-only access, and route statements to you.
- Remove access that shouldn’t still exist — a former VA, a previous bookkeeper, an old contractor.
- Move document exchange into a portal.
- Read your engagement letter and ask to add whatever’s missing.
- Request certificates of insurance, and ask which one covers clients.
- Open your audit log once, so you know where it lives before you need it.
Most of that is a one-time setup you never touch again.
Frequently Asked Questions About Bookkeeper Access and Security
Is virtual bookkeeping safe?
Yes, when access is configured correctly. A virtual bookkeeper with read-only bank access, no admin rights on your file, MFA enabled, and an engagement letter covering data ownership is lower-risk than a local bookkeeper with your checkbook. Location isn’t the security variable. Access design is.
Should I give my bookkeeper my bank login?
No. They don’t need it to do bookkeeping, and sharing credentials usually violates your bank’s terms of service. Use the read-only access your bank already offers. A firm that insists on the full login is describing a limitation of its own process, not a requirement of the work.
How do I give my bookkeeper access to QuickBooks without giving them my bank login?
Invite them as a user in QuickBooks Online at the access level the work requires, and separately add them as a view-only user at your bank. The two are unrelated — bank feeds pull transactions in through the connection you authorized, and your bookkeeper never touches your credentials to work with what arrives.
Should my bookkeeper be an admin in QuickBooks Online?
Not the Primary Admin. That stays with you, because viewing the audit log requires admin access, and the audit log is your record of everything that happens in your books. Standard or accountant-level access covers the work.
Does my bookkeeper need to be insured or bonded?
Neither is required by law and neither is universal, so you have to ask. E&O covers professional mistakes; a fidelity bond covers theft, and only a third-party bond protects you rather than the firm. Ask for both certificates, and ask the carrier to confirm in writing what’s covered.
What if my bookkeeper needs to pay bills for me?
Then they need transaction access, and that’s legitimate. Keep final approval with you so payments queue for your release, ask your bank about positive pay if checks are involved, and make sure you’re the one clearing the exception queue. Pair it with a real monthly review.
Ready to Set This Up Properly?
If handing over access has been the thing stopping you, I hope the risk feels smaller now and the fix feels closer. It really is eight items and an afternoon.
If you take nothing else from this post, take the two that cost nothing: hold Primary Admin on your own accounting file, and make sure your bank statements come to you. Those two alone put you ahead of most small businesses I see.
If you’d like a straight answer on whether your current setup has a gap in it, book a free discovery call. I’ll tell you what I’d change, even if the answer is that you should stay exactly where you are.
Not ready to talk to anyone yet? Grab the Bookkeeper Access and Security Checklist — every item here as a printable list, with the exact wording to use when you ask your banker and your bookkeeper.
Either way, don’t let the access question keep you doing your own books another year. Set it up right, then hand it off.