Who can get into your Xero, bank and email? A 30-minute access audit before you apply online

An online business loan connects three things you probably set up years ago and have not looked at since: your internet banking, your accounting file and your email. Before you plug them into an application, spend half an hour finding out who and what already has the keys. Old logins, forgotten apps and shared passwords are easy to fix today. They are much harder to fix in the week your loan money lands.

This guide is the audit, step by step, in the order that makes the most sense.

Why does access matter before you apply?

Think of an online application as a progress bar with three connection points:

1. Your bank. You connect it through open banking or upload statements, and later the loan pays out into it.
2. Your accounting file. Xero or MYOB shows the lender your invoices, debtors and profit picture.
3. Your email. The offer, the documents to e-sign and the settlement messages all arrive here.

Each one is a door. If someone you have forgotten about still holds a key, two things can go wrong.

The money is at risk. Business email compromise is where a criminal gets into a real email account and uses it to send fake invoices or change payment details. In the first quarter of 2025, Own Your Online reported that New Zealanders lost $7.8 million to cybercriminals, with about $5 million of that from unauthorised transfers or business email compromise, and more than half of losses falling on businesses (Own Your Online). A loan settlement is exactly the kind of large, expected payment these attacks hunt for.

The figures get muddy. A former bookkeeper who still has edit access, or an old app still pushing data in, can change what a lender reads. Unexplained edits and odd entries mean more questions, and more questions mean a slower answer.

Step 1: Who has a login to your accounting software? (10 minutes)

Open the users list in Xero or MYOB. You will usually find it under the settings for your organisation or company file. Go down it name by name and ask three questions.

• Do they still work with us? Former staff, a bookkeeper you replaced, a past business partner, an accountant from two firms ago. Remove them.
• Do they have the right level of access? Someone who only raises invoices does not need to see payroll or edit bank details. Most accounting software offers lighter roles, such as invoice-only or read-only. Use them.
• Is it really one person? A login called “admin” or “office” that three people share is a red flag. You cannot tell who changed what, and when one of them leaves you have to reset everything.

Keep your current accountant or bookkeeper. They are often useful during an application, especially if the lender wants management accounts or a quick explanation of a big entry. The point is not to lock people out. It is to make sure everyone left is someone you would hand the keys to today.

Then check the person who holds the subscription or owner role. If that is a former manager or a family member who stepped back, transfer it to yourself. The owner of the file should be the owner of the business.

Step 2: Which apps are plugged into your books? (5 minutes)

Accounting software makes it easy to connect apps: payments, point of sale, inventory, payroll, expense cards, reporting dashboards, and the occasional free trial from 2021. Each connected app holds a token that lets it read, and sometimes write, your financial data.

Find the connected apps list (again, usually in your organisation settings) and sort what you see into three piles:

Pile	What it means	What to do
Use it every week	Point of sale, payroll, payments	Keep. Check it is still connected properly
Used to use it	An old inventory tool, a trial you forgot	Disconnect
No idea what this is	A name you don’t recognise	Disconnect, then check recent activity

Disconnecting stops future access. It does not normally wipe the transactions already in your file. Be careful with anything that feeds sales or wages into your books, though: if you cut it off mid-month, the lender may see a gap. When in doubt, ask your bookkeeper first, and note what you changed and when.

Our page on linking Xero or MYOB to a loan application explains what a lender’s connection actually reads, and how it differs from these everyday apps.

Step 3: Who can see or move money in your internet banking? (5 minutes)

Most business banking platforms let you add extra users with their own permissions. Log in and look for the list of users or delegates.

• Remove anyone who has left the business.
• Check who can create payments or change payee details, not just view balances. That permission is the one that matters during a settlement.
• Set up dual approval for large payments if your bank offers it and it suits how you work.

While you are there, look at which third parties already have permission to read your account data. New Zealand’s regulated open banking is still rolling out, and older connections may have been set up through other methods. If you applied for finance before, or trialled a budgeting or cash-flow tool, there may be a live data-sharing permission you have forgotten. Our page on what you agree to when you share data for a loan explains how to read and withdraw those permissions.

Step 4: Lock down the inbox the loan will run through (10 minutes)

If you only do one step, do this one. Your email is where the offer, the e-signing link and the settlement details will arrive. It is also where a password reset for your bank or accounting software gets sent.

Here is the checklist:

1. Turn on two-factor authentication (2FA). Own Your Online tells businesses to start with their most important accounts, naming email and banking first. It recommends methods that use “physical key fobs, tokens or authenticator apps”, noting that codes sent by text or email “can be intercepted” (Own Your Online 2FA guide). Any 2FA beats none.
2. Check for forwarding rules. A rule that quietly copies or redirects messages containing words like “invoice”, “payment” or “bank” is a classic sign an inbox has been compromised. Delete any rule you did not create.
3. Review recent sign-ins and connected devices. Most email services show where your account has been accessed from. An old phone, a former staff laptop or a location you have never been to should be signed out.
4. Decide which address you will use for the application. Use one inbox that only you (and anyone you fully trust) can read. A shared “info@” address that five people check is not the place for loan documents.

Then turn on 2FA for your accounting software and internet banking too, if you have not already.

Halfway through and feeling organised? This is a good moment to start the 60-second enquiry. There is no credit check to enquire, and you can finish the audit while a specialist looks over your situation.

Step 5: Retire the shared passwords

Shared passwords sneak in everywhere: the bank login written on a sticky note for the office manager, the accounting password a bookkeeper still remembers, the email password unchanged since the business started.

• Change the passwords on your email, banking and accounting accounts, starting with the email.
• Make each one long and unique. A passphrase of several random words works well. Own Your Online’s password policy guide is a solid template if you have staff.
• Use a password manager so nobody needs a sticky note.
• Give people their own logins instead of sharing yours.

Step 6: Write down what you changed

Keep a short note: date, what you removed or changed, and why. It takes two minutes and it pays off twice.

If a lender asks why your sales feed stops for a fortnight, or why a user disappeared from your file, you have the answer ready. And if anything ever goes wrong, you have a clean record of when the access was tidied up.

What if you find something that shouldn’t be there?

Do not panic, and do not ignore it.

• Remove the access and change the password on that account.
• Check for damage. Look for new payees, edited supplier bank details, invoices you did not send, and changes to your own bank details in your accounting file.
• Call your bank straight away if any payment looks wrong.
• Report it through Own Your Online, the National Cyber Security Centre’s reporting site.
• Think about customer information. If someone may have seen personal details about customers or staff, the Privacy Act 2020 may apply. The Privacy Commissioner says a breach that “has caused (or is likely to cause) anyone serious harm” must be notified to the Commissioner and affected people “as soon as you are practically able” (Office of the Privacy Commissioner).

Tell your lender if any of this happens during an application. A good lender would much rather pause and confirm bank details by phone than pay loan funds into the wrong place. Our guide to payment redirection fraud covers the warning signs in more detail.

A worked example (illustrative)

A small Tauranga engineering workshop decides to apply online for working capital ahead of a busy summer order book. Before connecting anything, the owner runs the audit on a Tuesday evening.

• Xero users: five. Two belong to a bookkeeper who moved to Australia last year and a manager who left in March. Both removed. The office administrator is moved to an invoice-only role.
• Connected apps: nine. Four are in use. Three are old trials, disconnected. One the owner doesn’t recognise turns out to be a reporting tool a previous accountant set up. Disconnected, and noted.
• Banking: the departed manager could still create payments. Removed. Dual approval switched on for payments over a set amount.
• Email: no 2FA, and one forwarding rule nobody can explain that copies anything mentioning “remittance” to an outside address. Rule deleted, password changed, authenticator app set up, the bank called to check nothing has moved.

Total time: about 40 minutes. The next morning the owner connects the bank and Xero to the application, every connection works first time, and the documents go to an inbox only they control.

A tidy set of keys, then a 60-second enquiry

Most owners only audit access after something goes wrong. Doing it before you borrow means the money, the documents and the figures all travel through doors you control. It also tends to make the online journey smoother, because every connection is current and every login belongs to a real person. If you want a quick read on what else to sort first, try the online-ready score.

When you are ready, our enquiry takes about 60 seconds, and there is no credit check when you first enquire. Your details go to one team: we don’t send them to a pile of lenders, so your phone won’t fill up with calls from strangers. A real lending specialist reads what you send, looks at your individual situation and calls you to talk through the next step, including which connections and uploads make sense for you. Unsecured options typically run from $5,000 to $500,000, and property-secured lending from $20,000 to $5,000,000.

Please fill the form in accurately, including roughly what you need and how your business banks. Honest answers mean we can match you with the right option the first time.

See if you qualify →