How can a small business owner or their accountant stop and catch an employee who takes a customer's payment and then clears the unpaid invoice with a bad-debt write-off, credit memo, credit note or discount so nobody chases it?

What should I check, step by step?

1. Take credit and write-off rights away from anyone who receives, opens or posts customer payments. In a very small business, the owner approves every credit and every write-off.

2. Require a reason code and supporting document for every credit memo, credit note, discount and write-off: a return, a pricing dispute, a service problem, or written evidence of failed collection.
3. Each month, run a report of credits, discounts and write-offs by user and by customer. Look for one person issuing most of them, round amounts, amounts just under an approval limit, credits that exactly clear an invoice, write-offs of recent invoices or good customers, and credits soon after a payment should have arrived.
4. Confirm a sample of written-off and credited balances with the customers yourself, by a contact you already have. A customer who says they paid in full an invoice you wrote off as bad debt has found the scheme for you.
5. Watch the ratio of returns, allowances and credits to sales. It should move roughly with sales; a jump without a known product or service problem needs explaining.
6. Track what happens when money comes in on an account that was already written off. Recoveries should be visible to someone other than the person who wrote it off.
7. In QuickBooks Online, check the audit log filtered by user and by transaction type, and open the audit history on individual credit memos. You need admin access for the log, and events are kept for two years.
8. Keep a dated record of each approved credit and write-off outside the accounting software, so a credit that appears later without a matching approval stands out.

How do employees use write-offs or credit memos to hide stolen customer payments?

When a customer payment is stolen before it's recorded, the customer's balance in your books stays too high: they owe less than the books say. A 2014 Journal of Accountancy fraud quiz explains that a fraudster skimming customer payments may try to hide it by adjusting the receivable with credits or write-offs, and that confirming balances directly with customers and analysing adjusting entries to receivables can find credits recorded without authorization or justification.

• The same quiz notes that sales and returns and allowances normally move together, and that recording a sales return or allowance is one way to justify cash that's gone missing after a sale was recorded. So a rise in credits without a matching rise in sales is a warning sign whichever way the cash was taken.
• Write-offs are also how other schemes end. A 2022 McGrathNicol briefing on receivables fraud notes that lapping often uses write-offs to mask the missing funds, and suggests looking at the lag between credit notes being raised and refunds issued, whether the people raising credit notes are different from those approving them, and what documentation is needed before a debt is written off.

Who can write off an invoice or issue a credit memo in QuickBooks Online?

Intuit's QuickBooks Online steps for writing off bad debt are: review the A/R aging, set up a Bad debts expense account and item, create a credit memo for the customer using that item, then apply it to the open invoice through Receive payment. Anyone who can create credit memos and receive payments can therefore clear an invoice this way, so who holds those rights matters.

• QuickBooks Online Accountant also has a Write off invoices tool that finds invoices by age and balance and writes off the ones you tick in one step. Intuit's note on that tool says you don't need to enter your closing date password if you're writing off invoices dated before your closing date, so don't rely on the closing date alone to protect earlier periods from this kind of change.
• The QuickBooks Online audit log records who made each change, can't be turned off, keeps events for two years and needs admin access to view. It's a record after the fact, not a barrier: it shows a write-off only if someone looks.

How do occupational fraudsters conceal theft in the accounting system?

Occupational Fraud 2026: A Report to the Nations (2,402 cases) lists the ways fraudsters concealed their schemes: 19% created fraudulent transactions in the accounting system, 14% altered transactions in it, 12% deleted or omitted transactions, and 6% forced or altered account balances. Only 11% of frauds involved no concealment at all.

• Skimming, which includes write-off schemes on receivables, had a median loss of USD 45,000 and lasted a median 12 months. It appeared in 17% of cases at organizations with fewer than 100 employees and 6% at larger ones.