Enter your idea

Far more expedient than the employee having to send them, then wait for them to be processed, the payroll admin processing them and acknowledging the update. Also safer for the employee to update their bank details, rather than the information potentially getting lost.

I spent over an hour trying to work out how to change my account details and in the end needed to go through Xero Central and lodge a ticket - the whole thing took too long compared to other payroll companies who allow you to self update your bank details

This would be an excellent feature as employees change their accounts often. We dont have a dedicated payroll clerk. this is performed by the admin staff member who is always very busy doing a variety of tasks for the company.

I have used a competing system where users that had access to the app (their Xero Me equivalent) for their timesheets, leave requests, pay slips etc.

The greatest feature was the ability for the users to be able to update their bank account details themselves. Could this be a feature of Xero me?

Currently employees email the accounts team, however, previous experience has demonstrated most requests come from spam not the employee themselves. While it's easy to identify, there is still a risk.

Why should employers be responsible for updating bank account details - another manual function to add to the list! Please *** this next to address box

All other personal information can be updated from the employee, seems very logical to enable them to update any bank detail changes.
This should be a high priority!

agree they should be able to update their own bank details and addresses etc

A company we work with here in UK was recently a victim of an elaborate but simple fraud, resulting in the loss of around £5,000 from the payroll.

The scam went like this:-

1. Scammer fakes an email to HR from an employee requesting the bank details for their salary be changed.
2. HR fails to spot the "EXTERNAL EMAIL WARNING!" and forwards this email to the person who updates the payroll. They also didn't spot the fake email address, or double-check with the employee.
3. Bank details for the employee are updated in the payroll and bank payments.
4. Some weeks later, the employee concerned then contacts their manager as apparently they had not been paid this month. The fraud comes to light. "I never sent any email changing my bank details!" The scammer is long gone with the money. Whoopsie!

It would seem to me that the simple solution to this is not to accept, EVER, any instruction to change bank details via email. Instead, employees should be directed to a page internally or in our case in Xero, which can only be accessed by employees with a login and preferably requires two factor authentication.

The form could allow the employee to enter their new bank details. Xero sends a notification to the employee's known email/phone contacts to confirm the action, and then the person responsible for updating it receives a notification in Xero to update the bank details.

This approach would considerably reduce the risk of this type of phishing fraud, as any scammer would need to have access to xero and would have to get round 2fa, with at least two people checking the request before any bank details are changed, and not just fake an email: "Please to be updating my bank details... thx..."

Seems like obvious functionality to me. Please can this be added.

Yes - they should be able to add and amend bank details and pay disbursements, and expense bank accounts for reimbursement. Also absolutely should be able to amend their own address details!