{
  "question": "How can a small business owner or their accountant stop and catch an employee who takes a customer's payment and then clears the unpaid invoice with a bad-debt write-off, credit memo, credit note or discount so nobody chases it?",
  "slug": "how-to-stop-an-employee-hiding-stolen-customer-payments-with-write-offs-or-credit-memos",
  "url": "https://www.rightshold.com/answers/how-to-stop-an-employee-hiding-stolen-customer-payments-with-write-offs-or-credit-memos",
  "short_answer": "Treat every write-off, credit memo and discount as a payment you have to approve, because to the business it is one: it reduces what a customer owes without any cash coming in. The classic pattern is that a customer pays, the payment is taken before it's recorded, and the invoice the customer has already paid is then cleared with a bad-debt write-off or a credit so no one sends a reminder. The ACFE's fraud tree lists write-off schemes as a form of skimming receivables, next to lapping. The controls are simple: the person who receives or posts customer payments shouldn't be able to issue or approve credits and write-offs; each one needs a reason and a second person's approval before it's posted; and someone independent should review the month's credits by user and confirm a sample of written-off balances directly with the customers. In QuickBooks Online, a bad-debt write-off is just a credit memo applied through Receive payment, and the audit log, which can't be turned off, shows who made each one.",
  "checklist": [
    "Take credit and write-off rights away from anyone who receives, opens or posts customer payments. In a very small business, the owner approves every credit and every write-off.",
    "Require a reason code and supporting document for every credit memo, credit note, discount and write-off: a return, a pricing dispute, a service problem, or written evidence of failed collection.",
    "Each month, run a report of credits, discounts and write-offs by user and by customer. Look for one person issuing most of them, round amounts, amounts just under an approval limit, credits that exactly clear an invoice, write-offs of recent invoices or good customers, and credits soon after a payment should have arrived.",
    "Confirm a sample of written-off and credited balances with the customers yourself, by a contact you already have. A customer who says they paid in full an invoice you wrote off as bad debt has found the scheme for you.",
    "Watch the ratio of returns, allowances and credits to sales. It should move roughly with sales; a jump without a known product or service problem needs explaining.",
    "Track what happens when money comes in on an account that was already written off. Recoveries should be visible to someone other than the person who wrote it off.",
    "In QuickBooks Online, check the audit log filtered by user and by transaction type, and open the audit history on individual credit memos. You need admin access for the log, and events are kept for two years.",
    "Keep a dated record of each approved credit and write-off outside the accounting software, so a credit that appears later without a matching approval stands out."
  ],
  "sections": [
    {
      "heading": "How write-offs and credits hide stolen payments",
      "points": [
        "When a customer payment is stolen before it's recorded, the customer's balance in your books stays too high: they owe less than the books say. A 2014 Journal of Accountancy fraud quiz explains that a fraudster skimming customer payments may try to hide it by adjusting the receivable with credits or write-offs, and that confirming balances directly with customers and analysing adjusting entries to receivables can find credits recorded without authorization or justification.",
        "The same quiz notes that sales and returns and allowances normally move together, and that recording a sales return or allowance is one way to justify cash that's gone missing after a sale was recorded. So a rise in credits without a matching rise in sales is a warning sign whichever way the cash was taken.",
        "Write-offs are also how other schemes end. A 2022 McGrathNicol briefing on receivables fraud notes that lapping often uses write-offs to mask the missing funds, and suggests looking at the lag between credit notes being raised and refunds issued, whether the people raising credit notes are different from those approving them, and what documentation is needed before a debt is written off."
      ]
    },
    {
      "heading": "What the software lets people do",
      "points": [
        "Intuit's QuickBooks Online steps for writing off bad debt are: review the A/R aging, set up a Bad debts expense account and item, create a credit memo for the customer using that item, then apply it to the open invoice through Receive payment. Anyone who can create credit memos and receive payments can therefore clear an invoice this way, so who holds those rights matters.",
        "QuickBooks Online Accountant also has a Write off invoices tool that finds invoices by age and balance and writes off the ones you tick in one step. Intuit's note on that tool says you don't need to enter your closing date password if you're writing off invoices dated before your closing date, so don't rely on the closing date alone to protect earlier periods from this kind of change.",
        "The QuickBooks Online audit log records who made each change, can't be turned off, keeps events for two years and needs admin access to view. It's a record after the fact, not a barrier: it shows a write-off only if someone looks."
      ]
    },
    {
      "heading": "How fraudsters cover their tracks, per the 2026 ACFE report",
      "points": [
        "Occupational Fraud 2026: A Report to the Nations (2,402 cases) lists the ways fraudsters concealed their schemes: 19% created fraudulent transactions in the accounting system, 14% altered transactions in it, 12% deleted or omitted transactions, and 6% forced or altered account balances. Only 11% of frauds involved no concealment at all.",
        "Skimming, which includes write-off schemes on receivables, had a median loss of USD 45,000 and lasted a median 12 months. It appeared in 17% of cases at organizations with fewer than 100 employees and 6% at larger ones."
      ]
    }
  ],
  "checks": [],
  "ask_rightshold": {
    "start": "https://www.rightshold.com/start?ref=seo",
    "mcp_endpoint": "https://www.rightshold.com/mcp",
    "ask": "Open a human approval request before my bookkeeper posts a write-off. The action is writing off the open balance on one customer invoice as bad debt; I want my approval recorded against the exact invoice and amount before it goes into QuickBooks.",
    "mcp_call": {
      "tool": "request_human_approval",
      "arguments": {
        "action": {
          "type": "receivable_write_off",
          "invoice_ref": "INV-1042",
          "customer_ref": "CUST-0193",
          "amount_cents": 48500,
          "reason_code": "uncollectible_after_3_reminders"
        },
        "summary": "Write off the open balance on invoice INV-1042 as bad debt (bookkeeper request; owner to confirm with the customer first).",
        "expires_in_minutes": 1440
      }
    },
    "also": [
      "Needs your API key. Only the owner's account key can decide it (decide_human_approval); delegated agent keys are refused. The decision is a signed, timestamped receipt.",
      "verify_human_approval (free) with the receipt, its signature and the action as posted says whether it matches what was approved. A different invoice or amount gives a different hash, so it won't match. With only {id} it returns the status without comparing the action.",
      "To keep a dated record of each approved credit, seal it on a mirror ledger (REST, your API key): POST /v1/mirror-ledgers/{id}/entries with type adjustment, your invoice_ref, kind credit, amount_cents and customer_wording (the wording the customer sees, such as Bad debt write-off), plus your own fields such as approval_id and reason_code. GET /v1/mirror-entries/{id} is free to check.",
      "Use customer_ref and invoice references, not names or emails; entries with identity fields are refused."
    ],
    "scope": "Rightshold doesn't connect to QuickBooks, Xero, your bank or your customers, and it can't stop anyone posting a credit or write-off in your accounting software or detect one. It records the approvals and credits you send and lets anyone check them later, so it only helps if someone compares the credits in the books against them. QuickBooks behavior is from Intuit's help pages as checked on November 11, 2026; ACFE figures are from Occupational Fraud 2026. Not legal, tax, audit or accounting advice."
  },
  "sources": [
    {
      "title": "ACFE: Occupational Fraud 2026, A Report to the Nations",
      "url": "https://www.acfe.com/-/media/files/acfe/pdfs/rttn/2026/2026-report-to-the-nations.pdf"
    },
    {
      "title": "ACFE: The Fraud Tree 2026 (skimming receivables: write-off and lapping schemes)",
      "url": "https://cms.acfe.com/-/media/files/acfe/pdfs/rttn/2026/infographics/the-fraud-tree-2026-fem.pdf"
    },
    {
      "title": "Journal of Accountancy: What's your fraud IQ? (false write-offs, returns and allowances, 2014)",
      "url": "https://www.journalofaccountancy.com/issues/2014/aug/fraud-iq-20149743/"
    },
    {
      "title": "McGrathNicol: The risk in your receivables (credit notes, write-offs, lapping)",
      "url": "https://www.mcgrathnicol.com/insight/the-risk-in-your-receivables/"
    },
    {
      "title": "Intuit: How to write off bad debt in QuickBooks Online",
      "url": "https://quickbooks.intuit.com/learn-support/en-us/help-article/customer-refunds-credits/write-bad-debt-quickbooks-online/L88pSKtr9_US_en_US"
    },
    {
      "title": "Intuit: Write off invoices in QuickBooks Online Accountant (closing date note)",
      "url": "https://quickbooks.intuit.com/learn-support/en-uk/help-article/accounts-receivable/write-invoices-quickbooks-online-accountant/L5tnLclDb_GB_en_GB"
    },
    {
      "title": "Intuit: Use the audit log in QuickBooks Online",
      "url": "https://quickbooks.intuit.com/learn-support/en-uk/help-article/audit-log/use-audit-log-quickbooks-online/L2WoVnW6I_GB_en_GB"
    }
  ],
  "related": [
    {
      "title": "What is lapping, and how do you catch a bookkeeper moving customer payments between accounts?",
      "url": "https://www.rightshold.com/answers/what-is-lapping-and-how-to-catch-a-bookkeeper-moving-customer-payments-between-accounts-to-hide-theft"
    },
    {
      "title": "How to catch an employee skimming cash sales that never get rung up",
      "url": "https://www.rightshold.com/answers/how-to-catch-an-employee-skimming-cash-sales-that-never-get-rung-up"
    },
    {
      "title": "How to spot signs someone is hiding theft in your bank reconciliation",
      "url": "https://www.rightshold.com/answers/how-to-spot-signs-someone-is-hiding-theft-in-your-bank-reconciliation"
    },
    {
      "title": "How to prove small business books weren't edited after the fact",
      "url": "https://www.rightshold.com/answers/how-to-prove-small-business-books-werent-edited-after-the-fact"
    }
  ],
  "computed_from": "Curated guidance; license verdicts computed from Rightshold's license profiles at render time. Not legal advice.",
  "updated": "2026-11-11"
}