Website Security for UK Bookkeepers and Accounts Assistants

The Bookkeeper as a Gateway

A bookkeeper occupies a privileged position in any small business. They have access to bank accounts, payroll data, supplier invoices, client payments, tax records, and sometimes company credit cards. For a growing small business or a sole trader, the bookkeeper often has more visibility into the business's financial position than anyone except the owner.

This makes bookkeepers — and bookkeeping practices — an extraordinarily attractive target for attackers. Compromising a bookkeeper does not mean accessing one set of financial records. It means accessing the financial records of every client they work with.

UK bookkeepers are not always regulated in the same way as chartered accountants, but many are members of bodies such as the Institute of Certified Bookkeepers (ICB) or the Association of Accounting Technicians (AAT). Anti-money laundering (AML) regulations apply to bookkeepers who provide certain services, and HMRC supervises compliance. Data protection obligations under UK GDPR apply regardless of membership of any professional body.

What a Bookkeeper's Website and Systems Hold

**Client onboarding forms** — Name, business name, Companies House number, UTR number, VAT registration, bank details, and the nature of the bookkeeping engagement. This is a rich set of identity data for every client.

**Document upload portals** — Many bookkeepers use client portals or shared cloud storage (Google Drive, Dropbox, SharePoint) to receive invoices, receipts, and bank statements. These portals hold live financial data for multiple clients simultaneously.

**Accounting software access** — QuickBooks, Xero, FreeAgent, and Sage are commonly used cloud platforms. Bookkeepers typically have full admin access to their clients' accounts. A single set of compromised credentials can give an attacker access to bank feeds, payment runs, and payroll data across an entire client portfolio.

**Email correspondence** — The volume of sensitive financial information exchanged by email between bookkeepers and clients is enormous. Bank account details, invoice approvals, payroll figures, and tax submissions all flow through email.

**Invoices and payment requests** — Bookkeepers send invoices to clients. A compromised email account or a look-alike domain can redirect payment requests to an attacker's account — a form of invoice fraud that is extremely common.

The Specific Risks for Bookkeeping Practices

**Business email compromise (BEC)** — This is the number one risk for bookkeepers. An attacker compromises or spoofs the bookkeeper's email account, then sends payment instructions to clients. Because clients trust the bookkeeper implicitly with financial matters, they are likely to act on payment instructions without independent verification. BEC losses in the UK run to hundreds of millions of pounds annually.

The attack vector is almost always email. A bookkeeper with a weak email password, no multi-factor authentication, and a domain without SPF, DKIM, and DMARC records is highly vulnerable to having their email identity spoofed.

**Credential theft from the website** — A contact form or client login portal on a poorly secured website is a target for credential harvesting. Attackers inject scripts that capture what users type — including login credentials — and send them to a remote server. This can happen silently on an outdated WordPress installation without the site owner being aware.

**Phishing using the bookkeeper's brand** — If a bookkeeper's domain lacks email authentication records, attackers can send emails that appear to come from the bookkeeper to their clients. These emails might ask clients to log into a fake portal, provide bank details, or approve a fraudulent payment.

**Client portal data exposure** — Shared cloud storage used as an impromptu client portal often has overly permissive access settings. Files shared with one client may be accessible to others, or the sharing link may be set to "anyone with the link" — effectively making financial records publicly accessible to anyone who guesses or finds the URL.

**Accounting software API keys** — Some bookkeepers build integrations between accounting software and other tools using API keys. If those keys are exposed (for example in a GitHub repository or a website's source code), an attacker can access client accounting data directly through the API.

Anti-Money Laundering and Data Protection Obligations

UK bookkeepers providing certain services are required to register with a supervisory body under the Money Laundering Regulations 2017. This includes maintaining records of client identity verification (KYC documents), which adds another category of sensitive data to the mix.

Under UK GDPR, bookkeepers processing client data must have a lawful basis for that processing, maintain appropriate records, and implement technical and organisational security measures. Given that bookkeepers process financial data — and in many cases tax reference numbers and payroll data — the "appropriate" level of security is not minimal.

A bookkeeper who suffers a data breach affecting client financial records is likely to face both ICO scrutiny and significant liability to affected clients.

The Bookkeeper Security Priority List

**Email security is the top priority:** - Enable multi-factor authentication on your email account immediately — this single step prevents the majority of BEC attacks - Add SPF, DKIM, and DMARC records to your domain — these prevent spoofing of your email address - Use a professional email address on your own domain, not a Gmail or Hotmail account — free email domains cannot be properly authenticated

**Accounting software:** - Enable MFA on every accounting platform (Xero, QuickBooks, Sage, FreeAgent) - Review which clients each login has access to — use the minimum necessary permissions - Check your API integrations and revoke any keys you no longer use - Enable audit logging if the platform supports it, so you can detect unauthorised access

**Client document handling:** - Use a dedicated client portal (Karbon, Senta, Pixie, or similar) rather than generic cloud storage - Never use "anyone with the link" sharing for financial documents - Set expiry dates on shared links where the platform allows

**Your website:** - Ensure your contact and enquiry forms are served over HTTPS - If you use WordPress, keep it and all plugins updated - Use a strong, unique password for your CMS admin and enable 2FA - Add a Content Security Policy header to prevent script injection on contact pages

What a Security Scan Shows a Bookkeeper

A Yrzo AI scan of a bookkeeping practice website typically surfaces issues with email authentication records (missing or misconfigured SPF/DMARC), security headers on contact and portal pages, and exposed login endpoints without brute force protection.

These are not theoretical risks. Bookkeepers are actively targeted by criminal groups running BEC campaigns at scale. The tools to fix these issues — email authentication records, MFA, a properly configured website — cost nothing beyond time, and most can be set up in an afternoon.

The Essential scan covers your public-facing website and email authentication. If you have a client-facing login portal, the Professional scan covers authenticated testing of that login flow, session security, and API endpoints.

Given that the average BEC loss in the UK exceeds £10,000 per incident, a scan that takes under 20 minutes is a reasonable investment.