What does it mean when the audit history states an invoice was "added by system administration". I would think an invoice is always tied to a user.

Let me share some information about the System Administration showing in the Audit Log, anna54.

If you see a user you don't recognize, don't worry. QuickBooks Online (QBO) creates special users for a few specific situations. There are also several reasons you might see changes posted in the Audit Log as System Administration. This can happen for some reasons, among these are:

• You change a record, and the change affects another record. 
• You connect a third-party app to QuickBooks and the third-party app sends data to your account, or when it makes a change to your existing data.
• You create a recurring transaction, such as a recurring expense. When QuickBooks automatically adds an instance of the transaction to your books, a System Administration event appears in the audit log.
• You set up other events to happen automatically, even when you’re not signed in. Like System Administration event may appear when there's an update to your bank feeds.

To learn more about the Audit log feature, check out these articles: 

• How to view transaction changes in the audit history
• Use the audit log to re-enter deleted transactions

I hope that this response finds you with a smile. Keep me posted if you need a hand with running your financial reports or any QBO related. I'm always here to ensure your success. Take care always.

Unfortunately, this does not answer my question. Recurring transactions are never used. I am not sure if this is a system bug but I am concerned it could happen again. Is there any other reason why this could have happened?

Unfortunately, this reply did not answer my question.  Recurring transactions are never used. What is concerning is that this could happen again. Could it have been a system bug that created this invoice? I am hoping to receive another reply with further explanation. Thank you.

Rest assured that seeing the System Administration user in your QuickBooks Online (QBO)'s Audit Log page isn't a glitch in the system, @anna54.

Yes, you're right. Invoices are always tied to a user. However, when you modify an entry that also affects another entry the program will treat the activity as an automatic system update. That's why you're seeing that the action is made or added by the System Administration on the Audit Log page.

An example of this scenario is when you edit a payment to attach to a different invoice. The action will automatically be recognized as a system admin update. The System Administration may show up on the said invoice saying payment is applied or an “Indirect Edit” by the user who initiated the change.

Additionally, you can refer to this article to learn more about what the audit log can do and how to use it to keep an audit trail: Use the audit log in QuickBooks Online. It includes a detailed explanation about other special users such as online banking and import administration and support representatives.

Please know that you're always welcome to comment below if you have other concerns or follow-up inquiries about monitoring your transactions in QBO. I'm just around to help. Take care always.

Sorry to interfere in this tread?

In my case today the " System Administrator " added and send an invoice to a costumer on his own.

The invoice appear to be a duplicate from September.

Also, I found 2 instances when the account was accessed from a Chrome browser in Bothel WA., that is 2 hours drive from my location.

How can this be explained?

Thank you

No worries, you are always welcome to post your concern in the Community post's thread, Posillipo.

When creating a recurring transaction, QuickBooks Online (QBO) automatically adds an instance of the transaction to your books. Where the System Administration event appears in the audit log. We can also view transaction changes in the audit history to trace who access the account in a Chrome browser in Bothel WA.

If the user's name is not reflected in the Audit logs, I'd suggest contacting our Customer Support Team. They'll pull up your account in a secure environment and to investigate what's causing this issue. You may send a message via chat, call us at a time convenient to you, or we’ll get in touch with you instead. To ensure we address your concern, our representatives are available from 6:00 AM to 6:00 PM on weekdays and 6:00 AM - 3:00 PM on Saturdays, PST. See our support hours and types for more details about this one. Here's how to reach them: 

1. Go to the Help menu at the upper right.
2. Select Contact Us.
3. Enter your concern.
4. Click Let’s talk.
5. Choose Get a callback. 
6. Type in your contact info.
7. Select Confirm my call.

Visit our Sales and customers page for more insights about managing the company's income and customers.

I'll be right here to continue helping if you have any other concerns or questions about QuickBooks. Assistance is just one click away. Take care always.

But why would it create a new, "phantom" invoice?

There's a possibility that there are recurring invoices created in the system, JenGinther.

That's why QuickBooks Online created those transactions in the background. Please know again the recurring entries are created under a System Administration user, which is QuickBooks itself.

You need to check if there are active recurring templates from the list. Doing this will help determine if there were scheduled or duplicate invoices in QuickBooks.

Here's how:

1. Go to Reports.
2. In the "Find report by name" field, enter Recurring Template List.
3. Select Customize.
4. On the Customize report window, select Filter, then the Name checkbox.
5. In the Name field, select the customer's name.
6. Click Run report.

If there are duplicates, you can delete them:

1. Go to Settings ⚙.
2. Under Lists, select Recurring Transactions.
3. Locate the template name that is causing the duplicate transaction.
4. Select Delete from the Action column.
5. Choose Yes to confirm you want to delete the template.

For additional resources and troubleshooting solutions, check out this link: Create recurring transactions in QuickBooks Online.

Let me know if you have follow-up questions about invoices created by QuickBooks. I'm always right here to provide the information that you need.

The audit log states that system administration created a new non-existent bank chequing account and the payroll Direct Deposit payment account was automatically switch to this newly created bank account that some unknown system administration created ....talk about having zero faith left and therefore the only reasonable recourse is to switch to a more trustworthy product.

In our case, the "system administrator" hijacked my bosses login credentials and then proceeded to work under her name.  Before we caught it they had changed our phone number, our banking info and added quickbooks payments.  The hijackers then sent invoices to some company we've never heard of in the amount of $83,500.00.  I'm not sure why, but the invoices were paid (sent through QB pay) and forwarded to the hijackers bank account.

We tried to get in touch with QB support, the person we finally got through too didn't know where to send us.

We have sent messages etc. to no avail.  Still haven't spoken to anyone.   We did report it to the police.

We are not impressed!!! In fact looking for new accounting software.

Welcome back to the QuickBooks Community, Shelleyd22. I understand that things have been complicated for you about some unusual changes that have happened. Also, it's not the sort of experience we want you to have while utilizing QuickBooks Online. I'll make sure you're directed to the right person to help you further on the matter and confirm the cause of the problem.

Please know that we aim to deliver customer satisfaction at all times and fix or address an issue as soon as possible. Rest assured that one of our agents will assist you in securely reviewing your account and reaching out to assist with the safety of your account and resolving any impact from unauthorized access.

For now, I'm adding this article to see various details on how you can manage users' roles and limit their access to specific tasks: User roles and access rights in QuickBooks Online.

Don't hesitate to comment below if you have further questions about the user's access or any unauthorized transactions. I'm always around to help you, Shelleyd22. Have a great day!

@Shelleyd22 , What @ChristieAnn   isn't telling you, is that you need to get in touch with someone from the fraud dept.  

Maybe try https://security.intuit.com/contact-us ?  

Hopefully you can reach someone that can actually help, before things get worse for your company. 

Just_me,

Thank you for your input.  Last Thursday when we noticed this we did contact everyone and today I did

receive a call from customer support who is going to turn it over to the fraud dept.

Good luck. :)

Good luck. Please let us know what the fraud dept does to remedy your problem. This is quite serious.

Thank you.  I finally got a call yesterday from the elevated customer service.  He ask me some questions and then said he would forward it to the fraud department. Haven't heard anything yet.  This has been going on since July 28, 2022. 

FYI, We still have not heard anything!

Good morning, @Shelleyd22. 

Thanks for joining in on this thread again. This isn't the impression I want to leave you with. 

Often our fraud department will look thoroughly over particular situations and this can end up taking some time. However, I do recommend contacting our Support Team to let them know it has been more than three weeks since you've heard anything. 

QuickBooks Online Support

As always, please keep us updated on how the call goes. We want to ensure that this is getting taken care of as soon as possible. I'll be looking out for your response! 

Good afternoon Candice,

We have reached out to the escalation team several times.

"I understand your frustration with the issue. I have been trying to get updates to share with you but unfortunately at this time we do not have any updates. The issue is still under investigation and review. Once everything has been reviewed the Operational Support team will be in contact. "
This is the response I received.