Most established businesses have more than one person logging into the business account, and every login is a potential way in for fraud.
Regularly reviewing who has access, and what level, is one of the simplest controls available to reduce that risk.
Why access matters
- The more people who can log in, make payments, or view account details, the more potential entry points there are for a fraudster to exploit.
- Access is usually set up once and rarely revisited, so it often outlives the reason it was granted, after a role changes, or someone leaves.
- A fraudster doesn't need to target your strongest control. They only need to find whichever login or level of access is weakest.
- Broad access given to someone who only needs to view transactions, or make routine payments, increases the damage a single compromised login can do.
What reviewing access actually means
Reviewing access means matching what someone can do in your account to what they actually need to do their job, and checking that regularly. Allica's online banking supports three levels:
- Super user access gives someone full control: they can see everything, make payments, add new payees, and manage who else has access.
- Online access lets someone view account information and make payments, but they can't approve payments made by others.
- View only access lets someone see balances, statements and transactions, but not move money at all.
Why this control works
Most access problems aren't the result of malicious intent. They're leftover permissions: a staff member who left but still has an active login, someone who changed roles but kept payment access from their old one, or a laptop that's still logged in in a drawer somewhere. None of that is deliberate, but it's exactly the kind of gap fraud exploits, since nobody's watching an account that nobody remembers still has access.
Examples of how this looks in practice
- An account nobody remembered to close: a bookkeeper leaves a business on good terms, but their online banking access is never removed. Months later, their old laptop is lost or their email is compromised elsewhere, and whoever has it can still log in and see the account, because nobody thought to check whether that access was still needed.
- More access than the role requires: an office manager is given super user access when they join, simply because it's quicker to set up than working out what they actually need. Their login is later caught by a phishing email. Because their access was never scaled back to match their role, the fraudster who obtains it can add payees and move money, not just view the account.
Won't this cause friction for my team?
Not if it's done as a quick, regular check rather than a one-off audit.
Reviewing access doesn't need to slow anyone down day to day, it only means asking, every so often, whether each person's level of access still matches what they need. Most reviews take minutes and result in no changes at all.
How to review access with Allica
- Check who currently has super user, online, or view only access to your account, and confirm each person still needs it.
- Remove or downgrade access for anyone who has left the business or changed role.
- Keep the list of people with super user access as short as possible.
- Pair broad access with second payment approvals, so no single person can move money alone, even with full access.
- Set a recurring reminder, such as every quarter, to repeat the review rather than waiting for something to feel wrong.
Summary
Reviewing access costs nothing and takes minutes, but it closes one of the easiest routes fraud has into a business: a login nobody's checked on in a while.
If you'd like help reviewing who has access to your account, your relationship manager can talk you through it.
Worried about fraud?
Visit our Fraud Centre for immediate help and further advice.
