What should I do if I suspect someone has accessed my accounting account?

Act promptly. Use the provider’s official recovery process, secure the account from a trusted device and alert your IT support and CASS. Check for unauthorised changes, especially payment details. If money or personal information is affected, further reporting may be required.

Secure access first

Use official provider support rather than links in an unexpected message. Reset compromised credentials, check multifactor authentication and review active sessions and recovery details where the provider allows.

Check connected accounts

Email access can allow an attacker to reset other passwords or intercept invoices. Ask your IT support to check affected devices and connected services as well.

Preserve and review records

Keep suspicious messages and activity evidence. Check user permissions, supplier details, invoices and payments. Pause affected payment processes until the relevant details have been independently verified.

Escalate the incident

Tell the bank immediately if money is at risk. Assess fraud and personal-data reporting requirements with appropriate advisers. CASS can help review affected accounting records within the agreed service.