Unexplained change in employee bank details

Hi andrewb7, 

That’s definitely worrying, especially with bank details involved.

I can’t confirm from here whether it’s linked to the login change, but I’d suggest first checking the employee’s Payment Details and then running the Session Security Audit for the time the change happened under Reports > Accounts > Security and Audit > Session Security Audit. If it’s an online file, it’s also worth checking whether the Online Owner received a security email about the bank detail change. If the employee was set up through onboarding or self-service, you can also open the employee card and check Payroll Details > View PDF to confirm what was submitted.

As this involves payroll bank details, it’s also best to contact support directly so they can investigate it securely with you. You can reach out by creating a ticket  in My Account or connecting with our live chat team through MOCA, our virtual assistant. 

Regards,
Genreve

Hi Genreve,

As the online owner, I did receive a security email about the bank account change. However, there is no definitive way to determine who made the change (as far as I'm aware - the session logs don't tell me much). All users who had access denied making any change. I am nervous that it was a system generated change. Going forward, I will confirm every security emails. If I come across this again I will immediately contact MYOB.

Another question though ... the session security report (see attached) shows strange behaviour:

1. Why are there system logins?
2. Why are there numerous user logins when that clearly didn't happen?

thanks

Andrew

Hi andrewb7,

I can see why that might’ve seemed unusual at first, but you can breathe a little easier here. System entries on their own generally aren’t treated as suspicious logins. They’re usually just background or automated activity in the file, especially if you’ve got things like recurring transactions, invoice reminders, or other automated tasks set up. The main entries to keep an eye on are the named users, as those are the ones that show who’s accessed the file.

You’re doing the right thing by checking any security emails that come through, and if anything doesn’t look quite right, getting in touch with our team straight away is the best next step.

**I've removed the attachment for privacy and security reasons.

Cheers,

Princess