Security how-to · Updated November 2026
How to give a virtual assistant access to your accounts
Give your VA their own login at the lowest level that gets the job done, keep shared passwords in a password manager, and keep the power to move money with you. For bank accounts, that means they work from statements, a feed or a view-only user and prepare payments for you to approve, and they never get your bank login.
This is general security practice, not legal or financial advice. Banks and tools differ, so check your own bank's terms and what each tool offers. If you handle regulated or sensitive client data, ask your adviser what applies to you before you share any access.
The five rules
- Their own login. Separate logins mean you can see who did what, and remove one person without changing anything for anyone else.
- The least access that works. Start low and add more when a task calls for it. It's easy to add access later, and hard to know what was done with too much of it.
- A password manager for anything shared. Never chat, email or a spreadsheet. Group logins into vaults by role, so you can grant or remove a set in one step.
- A second person on money. Whoever sets up a payment shouldn't be the one who releases it.
- A list of who has what. Without an access log, you can't offboard someone properly. A plain sheet will do, and there's one below.
The access ladder
Put every tool on one of these steps. Most of a VA's work sits on steps 1 to 3.
- No access
You export or forward what they need: statements, reports, a file in a shared folder.
- View only
Their own login that can look and not change anything.
- Limited role
Their own login, set to a role that covers only their tasks.
- Prepare, then you approve
They set it up, and it doesn't go out until a second person signs off.
- Act within a limit
They can act alone, but the amount or scope is capped.
- Admin
They can add users and change settings.
Bank accounts: five setups, least access first
This is the question most people arrive with. You can get nearly all of the benefit without handing over any login. Start at the top of this list, and go only as far down as the work requires.
1. No bank access at all
You download the statements once a week or once a month and drop them in a shared folder. The VA reconciles from there. It's a few minutes of your time, and for many small businesses it's all the access a VA needs.
2. A feed into the accounting software
Connect the bank to your accounting software yourself. The VA gets a role in the accounting software and works with the transactions there, without ever seeing the bank's own login.
3. A view-only user at the bank
Many business accounts let you add users with view-only rights. Ask your bank, and use only what it offers formally. Personal accounts often have no such option, and if yours doesn't, stay with one of the two setups above.
4. Prepare and approve
If your bank offers a separate approver, the VA can enter a payment and you release it. Nothing leaves until you've looked at it, and you see the payee and amount each time. This is the setup to aim for if you want a VA to run bill payments.
5. A card with a limit
For subscriptions and small purchases, give them a virtual or prepaid card with a monthly cap, ideally one per purpose. If the number leaks or a charge looks wrong, you cancel that one card and nothing else is touched.
Never, on any setup
- Your own online banking login and password, even "just this once".
- One-time codes sent over chat or read out on a call.
- A photo of your card, or card details pasted into a message or a document.
- Remote control of your computer while you're logged in to your bank.
Controls to switch on before anyone touches money
- Alerts on every transaction, sent to you, by text or app, at the lowest amount your bank allows.
- A payment limit on any user who can pay, set as low as the job allows.
- A call-back rule. When a supplier's bank details change, someone phones that supplier on a number you already had, never one from the email. Put this in the SOP, because a fake "our bank details changed" email is a classic way to steal a payment.
- A monthly look. You read the statement yourself, even when someone else reconciled it. Ten quiet minutes catches most of what alerts miss.
What to give, tool by tool
| Tool | Give them | Don't give them |
|---|---|---|
| Delegated access, or a shared mailbox for the team address | Your personal password | |
| Calendar | Share it with edit rights | Access through your email login |
| Files | One shared folder for their work | Your whole drive |
| Password manager | Their own seat, with one vault per role | A shared master password |
| Accounting software | A role limited to entry and reports | Rights to add users or link banks |
| Payment processor | A support role, with refunds capped if it can do that | Rights to change payout details |
| Social media | A page-level role through the platform's business tools | Your personal profile login |
| Ad accounts | A role on the ad account | Control of billing |
| Website | Editor role | Admin, hosting or plugin rights |
| CRM and help desk | Their own user, with exports switched off if you can | A shared generic login |
| Domain and DNS | Nothing. Keep these yourself | Any login at all |
| Tax and payroll portals | Ask your accountant what they allow | Your personal government or tax login |
Setting it up, in order
- List the tasks, then the tools each task needs. Anything no task needs stays closed. Your SOPs already name these.
- Create a work email for them on your domain, so every tool's account belongs to your business and not to them.
- Add them to the password manager and share only the vaults their role needs.
- Turn on 2-step verification on that email, the password manager and every tool that offers it, set up on their phone.
- Add the logins and roles, and write each one in the access log as you go.
- Ask about their setup: a device with a screen lock and current updates, used only by them, with a separate browser profile for your work.
- Test it together on a call. The onboarding checklist has this on day 1, along with the rest of the first week.
Then review it. Every few months, go down the access log and ask of each line whether it's still needed. Access tends to pile up, and a quick look keeps it honest.
Copy these
Access log
Access log: one row per tool
- Tool: [name]
- Person: [name]
- Access level: [view / role name / approver / admin]
- Granted on: [date] by [name]
- Why they need it: [task or SOP]
- Review on: [date]
- Removed on: [date] by [name]
Offboarding: removing access
On the last working day
- Remove them from email and the password manager first
- Remove their role from every tool on the access log, working down line by line
- Cancel any card issued to them
- Remove them as a user at the bank and as a preparer on payments
- Sign out their active sessions wherever a tool offers it
- Remove their devices from any tool that remembers them
Straight after
- Change every shared password they could see, and move 2-step codes that sat in a shared vault
- Move files they own to your own drive, and give documents a new owner
- Check for forwarding rules on the mailboxes they used
- Check for new users, new payees and changed payout details in the last 30 days
- Mark the date on the access log, and keep the log
If something looks wrong
Don't wait to be sure, because you can apologise later. Do these in order:
- Remove the person's access to email, the password manager and anything that touches money.
- Call your bank on the number on your card or statement, and tell them what you've seen.
- Change the passwords on affected accounts, and sign out all sessions.
- Check for new users, new payees and mail-forwarding rules.
- Write down what happened, with dates and times, while you remember it. Then talk to your adviser.
The same steps apply when the person did nothing wrong and their laptop was stolen or their email was hacked. Often that's what it turns out to be.
FAQ
Can a virtual assistant manage my bank accounts?
A VA can do most of the work around a bank account, such as reconciling, preparing payments and chasing invoices, without having your login. Use statements or a feed into your accounting software, or a formal view-only user if your bank offers one. If they prepare payments, you approve each one. Keep the login, and the authority to move money, with you.
Is it safe to give a virtual assistant my password?
Avoid it. Give each person their own login wherever a tool allows it. When a tool has only one account, share it through a password manager vault, so it never sits in chat or email and you can remove it in one step. Never share your bank login. Many banks' terms say not to, so read yours and ask what access the bank offers for staff.
How can a VA log in without seeing the password?
Some password managers can fill in a shared login while hiding the password from the person using it. Check that yours can, and test it with a throwaway login first. Treat it as a useful extra and not as full protection, because a determined person can often still get a password out of a browser. It's one more reason to change shared passwords when someone leaves.
What about 2-step verification codes?
Each person should have 2-step verification on their own login, on their own phone. For a shared account that can't have separate users, a code stored in the password manager vault means you aren't forwarding text messages all day. Never ask a VA to read a code to you, and never send one to them for your bank. That habit is what scammers rely on.
Should a virtual assistant pay my bills?
They can run the process: collect invoices, match them to orders and set up payments ready for you to approve. A weekly approval slot keeps this quick. For small recurring costs, a capped card can pay directly. Check any change in a supplier's bank details by phone, on a number you already had.
When can I give a VA more access?
After they've earned it, one step at a time. Start with low-risk tasks for the first month, and move up when a review shows steady work and a real reason for the extra access. It doesn't need to be a judgment on their honesty: the fewer people with broad access, the less a stolen login can do.