317 Accounting Firms: Here’s How to Manage Client Logins

Today we are dealing with the bane of accountants existence, managing access to client information. You want to make it as easy as possible for them. So we're like, yeah, no, no worry about it, bro. We'll log in, we'll grab all that stuff our ourselves so you don't even have to lift a finger. And the idea is great, but managing access to all these, oh, frumpy old systems that clients use and having to deal with one time passwords and whoa. I just, I think I figured out a new way to Route A2FA code to this or here and then it doesn't break with the other system and you have to bug the client. And they're like, why are you both. This is so irritating. That's what we're talking about today. How to manage it, how to mitigate it, how to relegate it, and how to delegate it. Come on in. Scooch that chair up. It's Jason Daily time. Okay. To get direct client access to that bank, to that vendor, to whatever it is. To get direct access or not to. To get direct access. That is the question. I think most of us want to be white glove here and do it ourselves. And the idea of it is great and the client will love the idea of it, but the reality of it oftentimes is it is a, a big old pain. And everybody's hiney because you're going to have this client that's off running around going about their day and then some person is like, I'm going to send you a code and in a minute here, can you let me know when you're available? And then they respond four hours later when that person's at lunch or sitting on the toilet, not at their computer. And then an hour later they follow up the client again and they're like, okay, I'm ready now. And then the client's off doing something else and you're doing this back and forth and it's just super annoying. Or you call the client and interrupt them and say, I'm going to send you a code, whatever it is. It's just a pain. And oftentimes the person that's trying to log in and get that information isn't a person that the client may even know. Like it may not be their account manager. Because in all likelihood the senior person who onboarded the client and is having conversations with the client, you probably don't want that person logging into their bank and downloading bank statements or vendor invoices or whatever it is. Right? So how do we, how do we manage this. I would just start by, I would just start by pouring one out for hubdoc. Not today's hub doc, but the Hub doc of yesterday. That was the single greatest tool for this sort of thing. It wasn't perfect, it was so super broken, but it did this better than anyone else. And it would log out to all sorts of different vendor accounts and sometimes it would work and sometimes it didn't. And nobody has ever tried to solve for this Again the way that most of these systems work now. So like you know the way that QBO pulls bank statements, it has certain banks it works with where QBO will automatically pull in the bank statement. And that's awesome, that's killer. And I want to see 10 times as many of those things. So what we're talking about today is really all the stuff that falls through the cracks, which is a lot of stuff. And if you're not in the land of the free, you may be surprised by some of the things that here. And you're like, why is that hard? The short of it is there there's like 6000 banks in the US. In Australia there's like 8 banks in the UK. They have standardization around all the banks have to use a certain API and so there's a single API you can use for pulling transaction data. We have nothing like that in the United States of America because we found a better way. A way that is better enables capitalism and buying larger cars. So first off, is it actually better to self service versus have the client get it for you? It's very situational and there will absolutely be situations where I think it may actually create less friction and frustration if you just let the client get it. Some banks, some systems. And it's not just banks, it's, it's vendors. It's maybe a health insurance platform. A whole bunch of situations where we have to access something of the clients, maybe for making a simple IRA contribution. But some of these platforms will be so problematic that is the juice is not worth the squeeze and that sucks. That's really frustrating. But that is just how it is. So there, there will occasionally be situations where you need the client to do it themselves. And interestingly Megan Blair actually commented on this on social media, brought this up. She said she's actually switched a bunch of stuff to paper because it is easier to get a pile of paper and run it through a scanner in 20 seconds than it is to go and like log in and do this and do that. And gang, there's actually a lot of Truth to that, especially for the problematic platforms that are the ones that won't let you give access to a third party user, or uh, maybe some of these fussy ones that are particularly problematic, they probably have all sorts of ways to get that stuff via like legacy methods by like mailing it out or faxing it out or whatever it is. And as dumb as that sounds, the solution there may very well be that mailing it to you or mailing it to a virtual mailbox. Now, without going too far down the rabbit hole of virtual mailboxes, they're exactly what they sound like. Earth Class Mail was kind of the big one that popularized this. But you have all sorts of services like this that are like SOC 2, type 2, even HIPAA compliant, that ought to be secure. If the solution was to send things via paper, because that effectively in the end is going to look like getting something digitally, you can auto route the physical things that are scanned by that virtual mailbox to put them in a file system, not unlike taking digital delivery of a statement any other way. I don't want to go too far down that rabbit hole, but, but something to think about if that's a big problem for you. So honestly, three different options here. The client has to log in and get it, you log in and get it, or you get it a leg via a legacy method, which honestly is almost so uncool that it's cool. Now I would say getting it via mail, if you rely on the client to get you that thing, you need to have automated requests and automated requests reminders, because the job of following up with them to get that thing to you becomes just that, a job and a lot of work. And when those things pile up, those like just the air traffic control of knowing what you have and what you don't have and who you need to follow up with, it becomes a big old task. So your practice management system or a dedicated request platform, what that looks like is if this is tied to a month end close, it means if they have to log in and get that credit card statement that closes on the 25th of each month, then on the 26th of every month or the 25th, whenever the statement's available, that client's getting an email or a text or whatever's gonna work best for them reminding them, submit this to our portal here or send it to us via this method and every couple of days it auto follows up until they send that thing out. And even if you're starting smaller, if you're a new firm, you don't have all that many of these things and you're like, I don't need a dedicated software for that. This can catch up and overwhelm you so fast. So please, from the beginning, use software for requesting. Let machines do the requesting. Let the humans do all the other stuff that fall between the cracks. Because building up a huge list of things that need to be requested on an ongoing basis, it is frankly one of the most valuable uses of software to do that stuff and do the follow ups for you. Now on the subject of one time passwords, two FA codes, that sort of thing, I am very opinionated on this, at least how it works in the United States with United States carriers. A lot of people will tell you, oh spin up Twilio or this phone service or that service and it will solve this or that I will die on this hill until somebody proves it to me otherwise. Because you will see on social media a lot of what feel like fast slick solutions that are not that they're not complete solutions. So here's the truth. Here's what I truly believe is the best solution, not the best, the least bad of all the bad options, let's say an elegant solution to a problem that shouldn't exist in the first place. Here's what it looks like. Any services that require two factor codes where you're dealing with a shared login, which is already a worst case scenario. And we're going to talk about some maybe bigger picture zooming out solutions to that next. But if you're stuck in this situation, you don't have a way out. If you can get those codes via email, do that first. We're also going to circle back to like, does this bungle the entire security point of security? And in some cases it does. But if we're strictly talking about this from a standpoint of how do we reliably get access? If you can get codes via email, have them routed to a shared email. What I did in my firm was we had a quote, shared mailbox. That's what it's called in the Office365 ecosystem. A shared mailbox that a number of people can get into that is not a personal inbox that is then shared with someone else. All it is is a shared mailbox that doesn't belong to anyone in particular, but you can give different people like read and send access to it. For that shared mailbox we had a whole bunch of different aliases. So that shared. I think that shared mailbox was info@my firm.com but we would use various aliases to auto route the things that went to that shared mailbox. And one of the aliases we would use was two FA at our firm. So we had an email address, it was 2fa at our firm, and it was an alias for that shared mailbox. And on that shared mailbox was an inbox rule that would auto route anything that was sent to the alias to Fayorfirm.com does that make sense? So shared mailbox with an alias and then an inbox rule on that shared mailbox to auto route everything that was sent to the alias to a specific destination. In our case, that would get routed so that a message would be posted to our team's slack in a 2fa channel in Slack and anybody had access to that, they could go and grab the two FA code. Now, doing that, did that completely torpedo the point of like the security benefits of two factor authentication? Yes and no. It's still a whole lot. It's still way better than nothing, but. But not as good as the way that 2fa is supposed to work. But also, let's keep in mind we're living in a reality here where we are sharing a login that is a client's and you're sharing it with your firm. Like, this is already not a good spot. So there's a whole lot of reasons why we shouldn't be here. What I'm giving you is the best band aid I've found. So my team, they can see do you want the code sent to this email address? And they select that and it'll come through that little Slack channel in a couple seconds. Today's episode is sponsored in part by LifeFlow. Why run a big old fancy reporting suite when a spreadsheet will do, Arguably the spreadsheet, it's your natural habitat. No need to learn a new platform to get a. Get a PhD in how to use some big new FP. And a complicated thing when you can just plug your accounting ledger data into, straight into a spreadsheet. And if you've ever actually pushed reporting on clients, maybe your experience is different. I can tell you, in my experience it was. It's, it is a enough of a fist fight to just get them to open the email to look at a detached PDF, let alone like train them on a whole new platform, get them logging into a different place. But a spreadsheet, A spreadsheet you can point back to every single month, a spreadsheet they can bookmark, it's got all the information that they need. Some that static, some that updates on an ongoing Basis Live Flow can do that for you. And it's super quick and easy to set up. Integrates now with qbo, with Xero, with Excel, with Google Sheets. I see you, hipster accountant. Create that little report once and keep it sinking like forever. And you got one place for the client to come back to. A spreadsheet. Super easy to understand, to change. Even if it's just like pulling net income across all their different entities, it'll do consolidations. So even if it's like say a tax planning thing, we got to roll up, how much money have they made this year so far and is that on track with maybe how we projected taxable income would be looking this year? Bunch of different things that you can do with that from the comfort of your own home. A spreadsheet. P.O. box A1. Okay. And if that's your happy place, check out Lifeblow Link in the show notes. Today's episode is sponsored in part by Team up, your friends who are gonna help you find talented accountants in the Philippines. And they got a newsletter where you can sign up. Just get a little bit educated every week about what it's like working with offshore team members, a distributed team. The questions you're embarrassed to ask. Shop little tidbits to your inbox every week. Whether you've done this yet or not, it's worth just learning what that looks like. Teamup actually just hired two new recruiters in the Philippines. They're up to four total. So they've got recruiters on the ground in the Philippines who will go out and track down folks who are going to be a fit for you. Team up actually only launched last June. They've now worked with 85 firms, with one firm hiring 13 people. How's that for social proof? Honestly, that was my experience. Starting to hire folks in the Philippines. We got one, and then we're like, okay, how quickly can we get a second? And we just kept going because we had such good luck. In fact, as you saw in my podcast episode where I drafted my first 20 people to a firm. Like, if I were to start a firm tomorrow, like 50% of my hires in the Philippines, that's what I was doing in my firm when I left. That's how I do it again. We just got really, really good people. And Team up helps you do that. Team Up's approach is to help you hire direct, so you're going to work directly with that person. Rather than hiring a company who then employs the person, Team Up's approach is to hire direct. The other approach is called, it's called bpo. Basically the partnerships on all my content we've paired now to two companies, both who will find you accountants in the Philippines. One is a bpo, one is direct. Team up is direct. I would say pros and cons to each team ups doubling down on doing it direct. That's the way they to do it. And if that's something you want to explore, you don't cut a check until you actually make a hire. So hop on and call them, tell them what you're looking for, do some interviews and if you're not absolutely blown away by somebody, don't make a hire. Right. Worst thing you can do in this whole process is just learn more about what that looks like. So interested in hiring folks direct in the Philippines? Check out team up link down in the show notes. So if you can do it that way, great. But most of these services, they want to use a phone because phones have been like um, a for whatever reason are sort of this proof of identity or at least is a second thing that can verify that the person who owns this thing is the one that's supposed to be logging in to this computer. So how do we work around that? Well, a number of folks recommend online phone services like VoiceOver IP Systems, which I am a user of for sure. The problem is most banks will only send two FA codes to carrier numbers. They won't send two FA codes to what are called short code numbers or numbers used by these voiceover IP services. And there's no way around having a carrier number besides opening another line with a carrier. But if you're willing to do this, it actually isn't that costly. So ultimately what I did was I went up and spun up a $20 a month phone line on my Verizon plan and I had a phone with a carrier number that all of these codes got sent to. And that was the phone number that, that we always used anytime we had a login where we couldn't create multi user logins and it all had to go through a single place. So what do you do with this phone now? Well with iOS there isn't really a great way to automatically get SMS messages off of that. But with Android Buddy, anything goes. So there's all sorts of apps you can get on Android that will auto forward any SMS the phone receives to an email address, for example. And almost certainly these apps were stealing codes and all that stuff, but the codes themselves not valuable. Again, this is not as good as the right way to set this stuff up. And the most secure way to set this up. But this is. If this is the only way that you have, this is the best way to manage this right now. So that phone would literally sit there plugged into the wall and forward every text message to our2FA at our company email address and would get posted to that 2fa channel in Slack and it worked. We used this for years and it was the only complete solution we could come up with now. Now does it mean that you should do it? That is a very real question you ought to be asking yourself. This whole Jimmy rigged like codes being passed all around. This is still more secure than not having multi factor authentication on a login at all. Which I would argue is still the vast majority of logins out the out in the wild do not have any form of two factor. This awful system. It is still more secure than that. But is it great? Is it as good as it should be? Absolute, 100% lutely not. Which brings me to setting expectations with clients. Part of the problem here is we tell them oh we can log in and get everything ourselves. And then he tried to do it and you can't. And it requires a whole bunch of one time password shenanigans. Shenanigans with clients. And they're like I thought this was going to be easy and it's not. So here's the way we have to frame it up for our clients right now I think you want your clients in the US to basically be on one of two banks, either Relay or Mercury or, or both. I don't know why you do both, but knock shelf out. There are like lending based reasons to be on other banks. But in general, and I've done this with loads of clients, the terms of those loans will generally not require you to be doing everyday operational banking through that bank. Sometimes there will be like a minimum deposit balance that they want to see but by and large they are perfectly happy letting you run your day to day banking somewhere else. And so my framing for the client is this sucks because this platform sucks and there are better platforms. In fact the platforms that we recommend, the platforms that our firm runs on, we don't have any of these problems and they're much, much more secure. Because with Relay, with Mercury you can not only give third party access to your firm, but you do it the right way, which is third party access to individuals within the firm that all have different access levels. You know like a software product works, but there's not very many banks that support this. Now with Relay, with Mercury we can we can turn on two factor authentication. We could do MFA with an authenticator app. We can enforce that, which is how secure logins like this ought to be. And so the way we frame this with clients is yes, this process sucks because your bank sucks. Like not that directly but you know what I mean, they're feeling this pain and we can be like, we have a preferred solution to this pain. You come over here, we use this bank. I get it's a pain in the butt to switch and we, we will help you try to make that as painless as we possibly can. But getting you onto a modern bank, like that's going to set you up for the long term. And there's probably going to be some other benefits that come with being on that bank as well. Both of these actually do like bill pay and like virtual cards and other stuff like that. That's like really good sort of banking hygiene. So there will be annoyance with one time passcodes and having to do all that stuff. Your job is to just have a solution for that. To say like we can actually come over here and that's way better. Look at Mercury, look at Relay. Those are both past sponsors of my channels, but it's because I'm an actual user of both. I have accounts on both. I have put clients on them. I went to them and said sponsor my content. That's why they're sponsors. I have other banks that talk with me that are like we want you to promote our stuff. And I've said no. So that is, that is truly my recommendation. Getting your stuff on one of those two banks, uh, we'll link both down in the show notes. Relay and Mercury. Two more things I want to talk about. Who should be using these logins, these client logins and last a word on password managers. Where do all these credentials live? So the question of who should be using all of these logins. I've preached before the value of a pre accounting system, of creating a system for fetching and having all those items explicitly outlined. Like every little item that has to be fetched or got from the client in order to complete a month end close. We know what all those things are, we just gather them in a very inefficient way. Usually that is just kind of. It happens throughout the process as we need to go get that thing. But the reality is you know exactly what you need every single month to complete the close. There may be one off additional things but the foundational stuff that has to go in each close, you know what those things are and that is a task that can be deskilled. It's actually a. If you're running an efficient bookkeeping practice with, with bank rules and, and a lot of stuff set up that's not making that month and close a ton of work. The fetching and the gathering of all that information and putting those into the work paper file and annotating them is actually a huge percent of the month end close, upwards of 50% of the work on small month end closes. And it's something that we can descale out of the hands of our professional staff. It can be done by admins. You don't need a cpa, you don't need a high level accountant, you don't need a top level person to log into a bank to fetch a statement or an invoice, whatever it is. So where do we start? Step one and you can start this on a single engagement. Drop it in Excel, it doesn't have to be fancy. In fact, the leanest, most basic way to start is best because as you're going through it, you will learn more about what you need. Start super basic here with a single client, what are all of the items that have to go into a month end close? And the starting point to figure out what that is is look at the work paper file. It's usually going to be a collection of bank statements, probably going to be like payroll journal reports from the payroll system, maybe an AP summary from the accounts payable system. What are all of those things? These are all pre accounting tasks. Somebody is going in and running all of those things and probably right now it's whoever's responsible for the month end close, which is a higher level of expertise than is really required to go out and get all those things. So I would challenge you now start that on a single engagement. And right now as it stands, the status quo is the person that oversees that engagement is the owner of all those tasks on day one. And that's the worst that it's ever going to be because we're going to deskill that, delegate it to an admin. Now on that engagement, find a logical place to start reassigning those fetching tasks to an administrative member of the team. Consider what sort of access is required. Maybe they need access to the payroll system to be able to run the payroll reports, the bill pay system, that sort of thing. If that's the only reason they have access to these platforms, then ensure that the role that they have within those platforms is not one that gives them permission to pay or run A payroll, but one that is just more administrative, being able to run reports. Walk through that step by step until you've gotten that professional staff member off the hook, then go to a second engagement, then go to a third engagement. You're saving your most scarce professional folks a load of time. And fetching that stuff, as I've shared before, is just the starting point because what we found when we built this out in our firm and we built this out for literally every single thing that had to be captured on every single month end close. And it was a huge, huge value, everything down to like we had some banks where they had loans that wouldn't issue statements. So we just grab a screenshot and that was sort of our, our documentation. And so like the capture type or the fetch type was a screenshot of this. So really think through this to, to include as many things as you can in it. But then what we found is when the admin was fetching this stuff we're like well where are they going to put it? And so we would put like the destination and the folder structure of where it ought to go. And we're like, well they may as well rename it according to the naming convention. Well, they may as well annotate it the way that it got annotated last month, like highlight the amount, maybe put a work paper reference on there. And then what the admin started doing actually started looking a lot like the month end close. And if fetching all that stuff was maybe a quarter of the work that went into the month end close, there was at least another quarter of legwork that they could do that was just like one itty bitty step further of what they did with that document. And then they are really saving the professional team a pile of time. And we talked the other day about trying to like front load more work away from your constraints. And in an accounting practice it's usually the 5th to the 15th of the month that are sort of your, the constraint of your business that's there's only so many month end closes you can get done there. The other beauty here is the admin can fetch that stuff the day that it's available. So they're not going through and looking at an engagement and fetching all those things one by one. What they're doing is they're going through and you have a property in that pre accounting task list that is the day that it's available. Maybe it's the first, the second, the third, they're pulling everything across all clients that's available. On the second, they're pulling everything across. All clients that's available on the first in gusto, they're pulling it for this client, for that client, for that client, for that client. They're doing all that in batch from the system that you get that out of. Build.com, whatever it is. So the act of fetching is actually more efficient when you do it in a batched way like that and you're pulling it the moment that it's available. So when the professional gets in to do that work, it's just sitting there waiting for him. Half the work paper prep has already been done. That's a huge savings. This episode is sponsored in part by True Prep. If you are a tax pro, you know that your tax software, I'm talking US Taxpayer bro, your tax software is a treasure trove of valuable information. If only we could pull helpful things from it. But whatever your platform calls it, data mining, like whatever your version of that is, where you can like mass export information, it is just about the clunkiest thing you could possibly imagine. Which means we've never had an easy way to access all the data that is within our clients tax returns, which is so frustrating if you think about that. Who else is going to like do useful things with that data when you are the only one that has it. Like you're supposed to be the pro with the tools to glean insights from that stuff, yet it's like stuck in these awful systems. Well, great news. Today's sponsor, True Prep, they've built the. I don't know, the simplest way I can frame it is like chat GPT for tax pros. Basically you put your client tax returns into the system. It extracts umpteen different figures from those tax returns. And then with an AI assistant, you can chat and say things like show me all of my schedule C clients that had over 100k in self employment income last year. There was a lot of problems with that statement. Let's say that over 100k and Schedule C income, my clients who had over 10k and federal tax penalties, all of my clients who filed in Montana just being able to with a single query get a bunch of that stuff. Oh my gosh. And there's part of me that's like, well how do we even use this? Because it's not a thing that's really existed in a helpful form. You could do it, but it was so much work that we just never did. True Prep's building some really cool stuff here and it's backed with like actual authoritative literature from tax agencies as well. So you can throw some questions at it and it will give you a response with citations. So client sends you a question if you need some help answering it, even if you just need like quicker access to citations for the answer, you may know, chuck that question in there, it's going to answer it. Give you some resources. Save you a bit of time there as well. Pretty cool man. People actually doing meaningful things with AI to support tax pros. Imagine that. What a time to be alive. We did We've done a sponsored demo day for True Prep on my YouTube channel as well. Check out how that works. We talk through security practices, what you need to be thinking about with tools like this there as well. And that's True Prep. Learn more Check out the link down in the show notes Today's episode sponsored in part by Core V. I can tell you when it came to selling tax planning as we called it back in my day, it wasn't tax advisory. When it came to selling that to clients, the tools that I had to do that work was just a regular plain old tax software or bna, which is just the most visually painful program you've ever used. And to present that to a client, to be like, look at this smart stuff I've done. I just, I couldn't get my head around that. I think most of us can't. Core V on the other hand, super, super good at this. It's basically they have like they say over 1500 tax strategies so they will help you identify strategies for clients. But even as you hear that if you're a taxpayer, you're like what's a strategy? Do I really trust that? Here's the thing is unless we dress it up, unless we can call those things out that we are capturing for our clients, then they don't know that. They don't know the value we are realizing for them. And it may be table stakes for you, but does the client know that? They sure don't. And if you never tell them that thing that you did for them, they're not going to value you. But I know virtue signaling. I'm not going to spend a bunch of time beating my chest about the helpful things I did. Honestly, that's what Corby is great for. Tax advisory visualizations that show all the things you've done for them, how much money you saved them, even rolling year over year savings stuff as simple as entity selection. Simple is not the right word, but down to like where you setting reasonable comp, retirement contributions, all sorts of different things you can do Augusta rule visualizing all those savings in one place. Because your tax advisory work gang, it ought to be the best paying work in your tax firm. I did this mental exercise on the pod the other day. Say you got a thousand dollars a year tax client and all you do is tax prep for them. If we can get that same client to pay us another two grand for tax advisory so they pay us three grand a year, that tax advisory shouldn't be any more work than the tax prep itself. And if we can get clients onto that higher package, let's say we've got the same costs in the advisory work that we do in the tax prep work. Say you're running tax prep at 50% margin, that's 1000 bucks in costs, 3000 top line, that's 2000 profit. Now you double the amount of work that client is. But we 4x the profit while 2xing the work. So effectively for time put in, we're making 2x the money. And for every one of those clients you get on that plan, may you can cut one or you can go home to bed, take a nap midday and never go back to work. For tax firms, I genuinely believe like tax advisory is the path to that, to more freedom. Corvee. Really helpful way to visualize that stuff. We actually did a demo day on the YouTube channel for them recently so you can see how it works in like five minutes. Learn more about them, check out the link down in the show notes. So to bring this back to this episode and logins, who should be using the logins? Well if you're having to manage one time passwords passcodes with clients, you ought to have an admin where it's like you set the expectation with the client, this different person, the one that does all of this retrieval, they will be in touch with you because that's should almost certainly not be the person overseeing the month end close. So when you do that one time password thing, if you're having to do that hokey pokey, it may require an introduction introduction to that person to say hey, we have a team of people that does this fetching because it's purely administrative. So the admin will be in touch if they have to get that code from you. But the long term solution is getting onto a better platform where everybody can have granular access and the admins can have like you know, read only sort of administrative access, admin access. That's not the right framing read only access to be able to fetch just the documents that they need and an Upside to this actually is that you can remove some access from your professional staff where they're not going to need it. Their job is not to retrieve documents. And so in my case, we had like an admin team that would do all that retrieval and then we could remove access to all those sensitive credentials for the rest of my professional staff, which was a good thing. We actually consolidated access to a smaller number of people. Rather than everyone on our entire team having to have access to everything, which is ultimately more secure, we could lock that down with like requiring multi factor authentication. Which brings me to the last talking point here, password managers. So at a very minimum, password managers are an imperative if you manage client logins. It is frankly super irresponsible in 2024 not to be managing those passwords responsibly at a, at the very minimum in a password manager. But also pushing the value of multi factor authentication. The vast majority of data breaches happen due to unauthorized access, and the vast majority of unauthorized access scenarios can be eliminated by two factor multi factor authentication. And we need to educate our clients on this. And yes, it is an annoyance, but data security, honestly, is a big point, like a big aspect of running an accounting firm. There's virtually nothing that could wipe out or seriously disrupt your accounting firm overnight. If somebody got unauthorized access to everything in your firm and all of those Social Security numbers, tax returns, all, all that stuff ended up in the hands of somebody else overnight. Arguably that is one of the, if not the very biggest, existential crisis crises to your entire accounting firm where you have to send that notification out to clients because that happened. I don't know that there's anything else that could impact your, your firm overnight that is as significant as that. So you need good IT support. Like, you need to be on top of this stuff. Take it seriously. Do phishing, like phishing training with your team. Like actual, not actual, like fake phishing emails that go out to test your team. Like, you got to take this stuff seriously. There are services that will do that to try to catch your teams on things. You can see who's failing and who's not failing. I mean, in my firm we had someone who was really bad at this, who would always fail. And you have, I mean, you have to really seriously think about is it worth the risk to this firm. And this person was extremely capable in so many technical ways, but they would get suckered every single time. And you have to really seriously think about is it worth the risk to my entire firm for this person who's otherwise very Good technically to be under my employee. And we would get them all sorts of trainings and you know, each of those testing, test phishing emails would come with kind of companion training that would go along with it. But you have to see progress there. Like they have to start getting it. Otherwise that is, that's honestly a really big problem for your firm. So at a very, very minimum you need a practice man, a password manager. The, the better solution here honestly is an SSO provider, a single sign on provider. We've talked about em a bit. Basically your team logs into a single platform where they then have access to all their credentials. And the big benefit of a single sign on provider, one of them is they can't see the credentials of the platforms they're logging into. So if they've got a client's Wells Fargo bank login, they log into the SSO provider and then they click that Wells Fargo login for the client and it takes them into Wells Fargo without them ever seeing the credential. So they couldn't write that credential down on a post it note, they couldn't take it somewhere else. If two of your team members use that credential, it can get updated in one place and it updates for both of them. SSO providers offer other stuff like geolocking, like they can only ever log into that from the us you have an audit trail of every time they've ever logged in. Valuable stuff like that. Shockingly, there's really only one SSO provider in our space, Practice Protect who is a past sponsor. But I had my firm running on Practice Protect. The biggest non accounting space one is Okta Okta, an SSO provider. Like if you're thinking about what's the best way to do this long term it's an SSO provider. Like that's just more secure than anything else and we do need to take that seriously. The fact that clients entrust us with access to a lot of stuff, that there are very few things that are a greater sort of existential risk to the firm than a security breach. And the fact that I, I frankly don't want to rely on trust with my team. Like we talk about, like you're uncomfortable with running a distributed team or how do you trust folks to not steal time or whatever from you? It's like having people in your office I don't think was a source of trust. If they were going to steal from you out of the office, they would steal from you in the office. But oftentimes the solution to how do I hire Somebody across the country or across the world and be able to trust them. The solution to that in many ways is not having to trust them like we are accountants. Let's set up controls. An SSO provider is controls around the credential. I don't want to trust that my staff person will not go write down the credential of my client. That is a bank login where we can wire money somewhere. Don't, please don't blindly trust that. When there are solutions that can conceal that credential from your team member, that can make it so that with the click of a button, you can disable all their access to all those logins because you're disabling their SSO access, which is how they get to everything, rather than like, okay, they had access to a hundred credentials. Do we need to change all those passwords now? Because they could see them in the password manager, like password manager. Better than nothing. But an SSO is like a big step up as far as solutions go. Let's link practice, protect and let's link Okta down in the show notes, things to think about. Seriously, those. The hacks that I shared for managing two FA codes, they're like cool hacks and they work and it's the best sort of band aid for what the problem is. But also don't be afraid to invest in the underlying problem there. Getting folks onto better banking platforms because you are bearing some risk by being willing to do that whole credential sharing with the client. Let's say a client has unauthorized access to the bank credential that you share. That's sticky, right? Like, I don't know that I want to get into that. So there's, there's a very real, like personal decision here of are you even willing to do that? And frankly, I wouldn't, I wouldn't blame you if you weren't. That's a decision to make for yourself. But hopefully in here you picked up a couple of tidbits on how to manage this stuff because it is a real workflow headache. So any other hacks, things you've discovered? Man, let's, let's see that stuff in the comments. Hopefully this gets better over time as banking platforms mature, but it's still shocking, frankly, how much of a struggle it is. And if you're not in the us you wouldn't understand. Okay. You just wouldn't get it. All right? It's hard.