FRAUD RISK: Melio Integration with Quickbooks Online
During2020 and into 2021, Intuit Quickbooks Online added an embedded integration with the Bill Payments application Melio. As a ProAdvisor, I get to see when these products roll out and I am always excited to see QBO add value over time to make it easier to service my small business and non-profit clients. I always advocate for the use of QBO because of the constant improvements and capabilities that are implemented seamlessly.
When I noticed the roll out and the update to QBO, I tested out the Melio application not realizing what it was, and before I knew it, I had full access to send checks and online payments. Sounds great right!? That is what I thought at first, until I was processing the issue with segregation of duties. Here is why,most small businesses have two Quickbooks users, the owner, and the bookkeeper(in house), and typically, this bookkeeper already has full access to all the books and bank account. Some may be appalled at this but this is the reality,especially in a church or non-profit where human capital is limited. Since small businesses are already exposed to fraud risk from their bookkeeper, objectively,Melio was extremely easy to setup, and quickly provided unfettered access to approve and send payments via check and ACH to any vendor. So, where an owner may have been paying vendors via check with a signature, within 60 seconds the bookkeeper is able to setup Melio connection with QBO and start sending cash.Here is a video that shows the process to setup the application: (https://www.youtube.com/watch?v=5YdbvSD1MlU)
I thought to myself, there has to be a preventable measure here to ensure not just anyone can allow access to Melio, and like I said, in most cases the bookkeeper or office administrator has complete access to QBO and as a result can set this up. But as many QBO users know there is no expense approval system inherent in QBO, Melio does when you use it as a separate platform, but when you put these two together the approval system is nowhere to be found.
This is a huge breach of segregation of duties for a small business, employees with unfettered access and authority have a ample opportunity to take assets from the company. Many of you know there is what is called a fraud triangle which identify three aspects that contribute to fraud: (1) opportunity, (2) incentive, and (3) rationalization.You can see that the opportunity has been provided through this integration.
Fraud is real and business owners and organizational leaders need to address this quickly by taking the necessary steps, if you are using Quickbooks Online:
1. Check to see if Melio has been added as an app to your system: (https://quickbooks.intuit.com/learn-support/en-us/accountant-features/disconnect-an-app/00/185833)
2. Check your Bank statement to see if Melio has been used, “Melio” will show up on the bank statement as a descriptor.
3. Update your bookkeepers access to be able to change company details. [https://quickbooks.intuit.com/learn-support/en-us/set-up-users/user-types-in-quickbooks-online/00/186238]
This is not an article to put down bookkeepers, having appropriate boundaries in a business protects the owner and the bookkeeper equally. Owners protect your bookkeeper and protect your organization and take action today, open an honest conversation with your team and work together for a solution that works for you.
Harbor Business Solutions helps organizational leaders like you address issues like this, schedule an appointment with us and let us see how we can support you.
CFA - Fraud Triangle: https://corporatefinanceinstitute.com/resources/knowledge/accounting/fraud-triangle/
QBO and Melio: https://quickbooks.intuit.com/blog/whats-new/a-new-embedded-bill-pay-capability-in-quickbooks-online-and-quickbooks-online-advanced/
ACFE 2020 Report To the Nations (Fraud report): https://acfepublic.s3-us-west-2.amazonaws.com/2020-Report-to-the-Nations.pdf
Harbor Business Solutions will be reaching out to Quickbooks Online regarding this fraud risk to find a solution, updates will be posted here.
4.23.21 - A Feedback report was sent to Quickbooks Online