Invoice login security: 3 safeguards for teams

Key takeaways

• Use a long, random password that is unique to each invoicing account.
• Turn on verification for each staff member wherever billing accounts offer it.
• Save business records before removing a departing person's access on their last day.
• If a tool supports only a shared login, keep its password in a shared folder in the password manager.

The owner sets up the billing account. A bookkeeper signs in each month to match payments to bills. An office assistant creates invoices when the owner is busy with clients. Each of those logins can send a request for money in your company's name, change the details on a bill, and show who owes you what. That is a lot of reach for one password, and it deserves the same care you give your bank.

Consider a common situation. A bookkeeper works two days a week and keeps the invoicing password in a notebook at home. The assistant uses the same password for a personal shopping account. Nobody has changed it since the account was created. None of this looks dangerous on a normal day, but any one of those habits could let a stranger sign in and send a reminder that looks like it came from you.

The good news is that protecting these logins does not take an IT department. It takes three habits, and a small team can put all of them in place within a few working sessions. This post covers them in order: strong passwords that are unique to each account, two-step verification wherever the tool offers it, and a clear routine for removing access when someone leaves. The advice is written for owners and bookkeepers, but it works just as well for anyone who signs in to a billing tool on behalf of the business.

Start with a list. Write down every account that sends invoices, collects payments, or stores customer details. Next to each one, note who can sign in and how. Include old trials and logins created by former contractors when checking for accounts you may have forgotten. The list is the tool that makes the rest of this work, so keep it somewhere the owner can reach even when a staff member is out of the office. Include tools used for recurring invoices and deposits and partial payments.

How strong does a password for an invoicing login need to be?

It needs to be long, random, and used on no other account. A password manager is the easiest way to meet that standard without memorizing dozens of strings.

The Cybersecurity and Infrastructure Security Agency (CISA) states the basic problem plainly in its guidance on using strong passwords: "Simple passwords, such as 12345, or common identifying information, like birthdays and pet names, are not safe for protecting important accounts holding personal information." An invoicing login holds customer names, mailing addresses, and records of money owed, so it belongs in that group. A password built from the company name and the current year fails the same test, because anyone who knows the business can guess it.

CISA offers two practical routes. The first is a memorable phrase. In its words, "Another option is to create a memorable phrase of 4 – 7 unrelated words." The important word is unrelated. Four words that have nothing to do with each other, such as a kitchen appliance, a weather word, a color, and a sport, are much harder to guess than a sentence that reads naturally. Avoid song lyrics, famous quotes, and anything tied to the business, since those are the phrases people try first.

The second route is a password manager. CISA's advice is to "Create long, random, unique passwords with a password manager for safer accounts." The manager generates a different string for every account, stores it in an encrypted vault, and fills it in when you sign in. You still need one strong master password to open the vault, and that is the one password you memorize. For a small business this is usually the practical answer, since nobody can track a dozen unique passwords by hand.

Shared logins need one more rule. Do not hand one password to the whole team and call it finished. Where the tool allows it, give each person their own login. Then, when someone leaves or a laptop goes missing, you can remove one person's access without changing a password that everyone else depends on. Check whether your billing tool records who created or changed an invoice under individual logins; that record can help when a customer questions a charge.

If a specific tool allows only one shared login, store its password in a shared folder in the password manager, limit who can open that folder, and change the password whenever someone who knew it leaves. Treat that folder as the single source of truth. A password that lives in a chat message, an email thread, and a spreadsheet all at once has several places to forget to update.

Many bookkeepers work from a laptop in the morning and a phone in the afternoon, so make sure the password manager is installed on every device that person uses for billing. Check whether your manager can sync the vault between devices, so a new password saved on the laptop is available on the phone without retyping it. Check that the sync works before you rely on it. Also make sure the phone is locked with a passcode, because a phone that opens with no lock gives the password manager no real protection.

Rolling this out takes a few steps. Start with the accounts that can bill customers, since those carry the most risk. Install a password manager for each person who signs in, and have them save the master password somewhere safe that is not their work laptop alone. Change the password on each account in the vault, beginning with admin accounts, because those can usually add users and change settings. Then tell staff why you are doing it. People follow a new habit more willingly when they understand that a reused password lets one leaked account open the others.

Check the list you made earlier for any password that is reused across accounts, or that you would not want read aloud in front of a customer. Those go first. A password written in an old spreadsheet or on a sticky note by the monitor is a problem even if it is strong, because anyone who can see the note can use it.

Illustrative example: replacing a reused password

Save each account in the password manager, then replace the reused password with a different generated password for each account. Check that each saved password works before moving to verification settings.

Should staff use two-step verification on billing accounts?

Yes. Turn it on for every staff member on every billing account that offers it. A password alone protects an account only until someone else learns it.

Two-step verification adds a second check when someone signs in. The second check usually comes from a phone app, a text message, or a physical security key, depending on the tool. Notion's help center describes the feature this way: "Add an extra layer of account security with a second method of verification, also known as 2FA or MFA." Treat its page as an example of how these settings are described, not as a rule for your software. Your billing tool will have its own menu and its own name for the feature.

The Notion page also shows what setup looks like: "Under Account security, select Add verification method next to 2-step verification." Other tools use different wording, so look in the account or security settings for words such as two-step, two-factor, or verification. Once the feature is on, sign out and sign back in once. That confirms the second check appears when it should and that the person can complete it before they need it on a busy afternoon.

Several details decide whether two-step verification helps day to day. The first is who owns the second device. It should belong to the person signing in. If one shared phone receives every code, the second check is shared too, and most of its protection is lost. Each staff member should register their own phone or security key.

Plan for a lost or replaced phone next. Many tools offer backup or recovery codes when you set up the second check. Save them somewhere the owner can reach, such as the password manager or a locked folder that two people know about. Without them, a lost phone can lock out the only person who knew how to sign in.

When a tool offers more than one option, choose the one your team can use reliably. An authenticator app or a security key often works well for people who move between devices, and it does not depend on a single phone number. Pick the option that the person who signs in most often can use without help.

Staff also need to know what to do when a code or prompt shows up unexpectedly. A verification code belongs to the person who requested it and nobody else. Nobody should read a code aloud on a phone call, forward it in a message, or type it into a form that a customer or vendor sent. CISA's guidance includes a story that makes the point: "Emma was alarmed when she received a text alert from her bank confirming a $700 transfer request she hadn’t made." An alert about activity you did not start is a signal to stop, not a prompt to approve. The same reasoning applies to a billing login. Change the password, check recent activity if the tool shows it, and contact the vendor's support page before doing anything else.

Suppose a staff member loses a phone in the middle of a billing cycle. Do not rush into the account settings and turn the second check off. Use the recovery codes if you saved them, or contact the vendor's support page to confirm who the account belongs to. Once the person is back in, register the new device, generate fresh recovery codes, and save them in the same place as before. Update the phone number on the account too, so verification messages go to the current number. Write down the date of the change in your list, so the next person who looks at the account knows what happened.

Start with the accounts that matter most. Admin accounts come first, because they can usually change payment settings and add users. The bookkeeper's account and the assistant's account come next. Anything that issues invoices or collects payments belongs ahead of tools that only store records.

The owner's own account deserves the same treatment, even though it is tempting to skip. Owners often hold the most powerful login in the company and sign in the least often, which means the second check is the one they forget. Set it up while you do the rest, then test it the next time you sign in. A short walkthrough with each person also helps. Show them where the setting lives, what the prompt looks like, and who to call if a code does not arrive. Ten minutes of practice is far cheaper than a locked account on the day a customer payment is due.

What should you do when a staff member leaves?

Remove their access on their last day, after you have saved any invoices, customer notes, or files the business will need later.

This is the safeguard that is easiest to forget, because it looks like paperwork rather than security. A former bookkeeper who still knows the shared password, or a contractor whose login was never removed, can keep sending invoices long after they have stopped working for you. Temporary staff and contractors are a common gap, since their accounts are often created quickly for a project and left behind when it ends. Put every outside person on the list from the start, with the date their work is expected to finish, so the end date is written down before anyone needs to remember it.

Microsoft's guidance on removing a former employee starts from the same goal: "Prevent former employees from accessing your Microsoft 365 services and organization's data." Microsoft 365 is a different product from most invoicing tools, so use its rules as an example of how removal and data retention can work. Your invoicing software will have its own steps, and you should read them before you start.

The Microsoft page also shows that removing access and deleting data are separate steps with separate clocks. It says that when you remove or delete a license, "the former employee's email, contacts, and calendar are retained for 30 days, and are then deleted permanently." For deleted accounts, the same page says: "After you delete an employee's account, the content in their OneDrive and Outlook is retained for 30 days." It also explains that "During that 30 days, you can restore the user's account, and gain access to their content." Other vendors set their own windows, so find out yours before you delete anything, and write the date down.

The practical lesson is that you may be able to get something back for a limited time, but you should not count on it forever. Export what matters while the account is still active, and treat the restore window as a safety net rather than a backup plan.

Here is a routine you can reuse for every departure:

1. Save what the business needs. Export or download invoices, customer lists, payment records, and any notes the person kept in the billing tool.
2. Block sign-in on the departing person's own account, so they cannot log in even if they still remember a password.
3. If the person knew a shared password, change it now. Give the new password only to people who still need it, and store it in the password manager vault so there is one current copy.
4. Remove them from the list you made at the start, and note the date you did it.
5. If the vendor shows a retention window, write down when content will be permanently deleted, and set a reminder to check before then.

Access also needs to change when a role changes, not only when a person leaves. A staff member who moves from billing to payroll, or who takes on a new client account, should lose the billing permissions they no longer need. Review those changes on the day they happen, not at the end of the season, because a permission left in place for months is still a way in. Ask for the change in writing, the same way you would for a departure, and update the list so it shows what each person can do today.

Finally, review the list on a regular schedule. Remove anyone who no longer needs access, even if they never signed in. An account nobody uses is still a way in, and it is easy to forget until something goes wrong. A quick look at recent sign-in activity, where the tool shows it, can also reveal logins from places or devices nobody on the team recognizes.

What can you do today?

List your billing accounts today, then choose an admin account and check its password, verification settings, and current users.

How should you handle common login problems?

What if a billing tool allows only a shared login?

Use the restricted password-manager folder described above, and include that login in every departure review.

What if a staff member loses their verification phone?

Use saved recovery codes or the vendor's account recovery process before registering the replacement device.

Does deleting access also preserve billing records?

Do not assume it does: check the vendor's retention steps and save business records before deleting the account.