Locking Down Xero, MYOB and Your Accounting Stack

Xero or MYOB holds your invoices, your supplier list, your payroll details and a live connection to your bank. To an attacker, a hijacked accounting login is better than malware: it lets them send real invoices from your genuine system — with their bank details on them — to customers who have every reason to pay. Securing it deserves an afternoon of deliberate settings, not default ones.

The account itself

• MFA on every user, no exceptions — app-based, not SMS where you can choose. This is the single control that defeats most account takeovers.
• Unique passphrases stored in a password manager — the accounting login must never share a password with anything else.
• Least-privilege roles: the person who raises invoices does not need payroll admin. Both platforms support granular roles — use them.
• Remove access the day a staff member, accountant or bookkeeper finishes — and review the full user list quarterly. Old adviser logins are a classic quiet backdoor.

The connections around it

Your accounting file is only as secure as everything plugged into it. Audit the connected apps and add-ons list: each one holds an ongoing key to your data, so remove anything you no longer use and be choosy about what you approve. Give your accountant and bookkeeper their own logins — never a shared password. And remember the reset path for your accounting platform lands in your email inbox, which is one more reason email security and MFA come first.

The fraud rituals

• Any change of bank details — a supplier’s, an employee’s payroll account, anyone’s — gets verified by phone on a number you already had, every single time.
• Turn on notifications for new payees, new users and role changes, so surprises surface immediately.
• Reconcile weekly, not quarterly: payment redirection fraud that’s caught in days is sometimes recoverable; caught at BAS time, it almost never is.

None of this needs new software — it’s settings you already own plus habits that cost minutes. Given what lives inside your accounting stack, few afternoons of security work pay better.