Fraud Management

Hi Komal_S 

Thanks for your reply :-)

Hi lkmcc 

Not sure how to answer this without writing a book, though I am not trying to be flippant. 

Over almost 30 years of using MYOB and doing book-keeping I can say 99% of fraud has been internal and by trusted employees.

There are certainly many many simple things you can implement in MYOB security features that can eliminate most of the opportunities - however, unfortunately this forum makes it a bit difficult to air such things without actual  proof of credentials in that we actually don't know who you are - whether you are an employee or owner and the post may be a simple and innocent question, but it may be mining to gather clues on how to do (not so innocent things) in MYOB.

I think it behoves us on the forum, those who have substantial knowledge on how MYOB functions, and this certainly is intented for good use - but unfortunately I have seen bad book-keepers and have been asked to audit files by auditors to find problems.

I would be quite happy to write a checklist of such things, as would other very experienced CC on this forum but I would suspect their views to be similar to mine - we cannot authenticate who is asking.

The Doc

Hi The_Doc 

I am a newbie user just seeking assistance to protect the company and myself in a new position I am moving into after doing some risk analysis and finding holes -  I'm not asking for step by step instructions, just suggestions on MYOB fuctions that I can look into so that I can better utilise MYOB and protect those that have access and the company. I am aware that most fraud happens from trusted employees, hence my comment about the majority of websites suggesting to "know your employees" - not very helpful or robust at all.

I have never used this forum before and as a relatively basic MYOB user looking to learn and implement change within my organisation, I thought this was the place to ask questions and learn - seems I will need to seek guidance from elsewhere.

Thanks,

lkmcc

Hi lkmcc 

When any changes are made to the online files in terms of sensitive banking or personal information, security emails are sent to the Administrator to notify. Besides this, the session security and audit reports can also be checked for any suspicious activity. We would also recommend having a look at this help article for general tips on protecting your company file from fraud. 

Hi lkmcc 

Unfortunately the article referred to by Komal_S  is generic, due diligence on MYOB's part (which I understand) but in the scheme of things - just too complex.

MYOB's security system to their layers of MYOB is way to complex to ensure that you have protected all sensitive areas - and I have been using using MYOB for a long time - it just is way too complex.

However, there are simple procedures that cover most bases of avenue that are open to being used to scam money.

They are simple, and are not giving away secrets or procedures within MYOB to cover fraud - just ways to stop them from happening

1. Never give out your main bank accounts access to anyone except a trusted person - single person - 100% trusted member.

2. Reconcile ALL main accounts where money comes out of - 2 or 3 times a day - I do not use bank feeds (they are useful but I do not use them, I tried and they created hell)

3. Reconcile your credit cards 4 or 5 times a day - this pays dividends - and know ahead who is buying what with a limit on unauthorised single credit card purchases.

4. Ensure you get receipts for c/c entries through the app capture - always and on time.

5. And the biggee !!!! - I never ever use banking upload templates! as these grab bank accounts from within MYOB to upload - sure people will argue this is very useful - sure is - great for big corps - big supplier payments but great for scamming.

I ALWAYS SETUP SUPPLIERS in the Commercial Bank portal - and build templates in there to use ONLY the bank accounts I have set in there.

Sure takes more time and is a bit painful - but so far I have never paid any supplier, any staff or anyone to a wrong account.

The above are simple tricks - simple procedures that are not giving away the crown jewels of the business but thwart 99% of scams.

Sure MYOB has 2FA and the bank does also - and the likelihood of anyone getting into these and changing these is smalll - but 99% of fraud is by someone known to the system.

Hope this helps

The Doc

Hi lkmcc

Have a look at the Manage roles in (Setup/Users)  you can restrict Prepare Electronic Payments to Administrator Only

There are a multitude of options for users.

Gill

Hi Beansmutts 

Whilst your advise is generically correct, unfortunately that part of MYOB's security overlay is so complex that any reliance on it as a means to limit fraud essentially worsens the situation in that - unless you understand this area totally it is too easy to leave other areas, unintentionally,  wide open for fraud.

Certainly, this area is a starting point but unfortunaltely, as I have found, locking things down restricted staff so much they couldn't do there job and telling the boss you did it to stop possible fraud is likely create a whole new area of woes.

Yes - locking this area down is the beginning but unless you REALLY understand it it is likely just cause you a headache..

There are so many things long before you actually get to this area to implemment.

eg. staff access to the file could only be through an email registered to the company and the 2FA had to be via 'that email' and NEVER allowed on the staff members phone.

And staff were never allowed to put their business email account onto their phone.

These are just basic security measures and there are many more that are done long before a staff member gets anywhere near the MYOB file.

Locking out 'Prepare Electronic Payments' is unfortunately a false sense of security if staff can get at the supplier or employee bank details in MYOB and change them - electronic payments merely inherets these (which may already be changed).

However, as previously suggested - I never import an MYOB template to the bank and use already built templates in the banking profile so I never inheret new account numbers.

Security is a very complex problem that is not merely plugging possible holes where fraudsters can crawl through.

The Doc