Most fraud in a small practice comes from simple gaps: one person who can both move money and record it, nobody reading the statements, and bank details changed by email. A few habits close those gaps without slowing you down.
Limit who can move money
- Keep the list of people who can pay bills, issue refunds or send transfers short.
- Give staff their own cards with low limits, never your card.
- Turn on alerts for every payment over a set amount.
Two sets of eyes
The person who pays the bills shouldn't be the only person who reviews them. In a small practice, the second set of eyes is usually you. Your bookkeeper reconciling every account each month is another layer, because a payment nobody recognizes shows up as a question. Here's what reconciling involves.
Read your own statements
Once a month, open the actual bank and card statements and scan them. It takes 10 minutes. Look for vendors you don't know, round-number transfers, refunds you didn't expect, and payments to a person instead of a company.
Watch refunds
In your membership platform, limit who can issue refunds and review them monthly. In a made-up example, a staff member with refund access sends $90 refunds to their own card a few times a month. Each one looks small. Over a year, it adds up to thousands, and it only shows up if someone compares refunds with real member requests.
Never change bank details by email alone
A common scam is an email that looks like it's from a vendor or staff member, asking you to update where payments go. Before changing any bank details, call the person at a number you already have, not one in the email. Do the same for payroll direct deposit changes.
Keep payroll clean
- Review each payroll before it's approved.
- Check for people who no longer work for you.
- Watch for hours or pay rates that changed without your say.
Lock down your logins
Use a password manager, give every staff member their own login and turn on two-step sign-in for your bank, payroll and membership platform. When someone leaves, remove their access the same day. Shared logins make it impossible to tell who did what.
Once a year, go through every account that touches money, from the bank to the payroll service to the card processor, and check who has access. Remove anyone who no longer needs it, including former bookkeepers, old staff and vendors who set something up years ago.
What I'd do this week
- List everyone who can pay, refund or transfer money, and remove anyone who doesn't need to.
- Turn on payment alerts at your bank.
- Read last month's bank and card statements yourself.
- Set a rule that bank detail changes need a phone call to confirm.
Common questions
I trust my staff. Do I need this?
Controls protect your staff too. When money is handled cleanly, nobody is ever under suspicion when something looks off.
What if I find something?
Don't confront anyone right away. Save the records and talk to your attorney first about the next steps.
Should I have insurance for this?
Some business policies cover employee theft or fraud. Ask your insurer what yours includes.
Want every account reconciled and reviewed each month?
We reconcile every account every month and send your P&L and Balance Sheet by the 15th, so decisions like this start from real numbers. If that's what you need, apply to work with us.