Who Approves a Change to an Employee's Bank Details?

A salary run is a list of account numbers. Nothing else about it is really the money. The hours were counted honestly, the deductions were right, the net figure was checked twice, and then eleven digits decide where it lands.

In most small Indian businesses, one person owns all eleven of those digits. The office manager collects the bank passbook photos on WhatsApp, types them into a spreadsheet, and the spreadsheet is the payroll. Nobody else has ever read it. That is not a story about a dishonest manager. It is a story about a control that was never built, and it stays invisible until the month it does not.

The edit nobody sees

A first entry is visible. Somebody joins, somebody types their account, the first salary arrives and they say so if it does not.

An edit to an existing record has none of that. Ramesh has been paid into the same account for fourteen months. In the third week of a month, two digits change. The salary goes out on the first. Ramesh says nothing until the fourth, because he assumed it was late, and by then the money has moved twice. When you go looking, the spreadsheet shows only the current value. There is no previous value, no timestamp, and no name against the change.

Every part of that is ordinary. The fraud, if it is fraud, needed no technical skill at all. It needed a field that one person could edit alone and a record that kept only the latest answer.

The ACFE's Report to the Nations, now in its fourteenth edition and the largest global study of occupational fraud, reports the same thing every time: organisations with anti-fraud controls in place lose less and find it sooner. The controls that do that work are unglamorous. Separation of duties is the plainest of them.

Why the law got you halfway there

Section 15 of the Code on Wages, 2019 set the mode of payment:

All wages shall be paid in current coin or currency notes or by cheque or by crediting the wages in the bank account of the employee or by the electronic mode.

Code on Wages, 2019, s.15

Section 17 then fixes when: for monthly staff, before the expiry of the seventh day of the succeeding month. You can read both in the official text on the Ministry of Labour and Employment's site.

What those sections do is remove cash from the equation and put a bank account at the end of every pay run. What they do not do, anywhere, is say who inside your business is allowed to decide which account that is. That question is left entirely to you, and most businesses answer it by accident: whoever was given the spreadsheet.

The four things a real control does

Separation of duties is a phrase from audit manuals, and in a fifteen-person business it collapses into four practical requirements.

The third one is the one people forget. If the manager who enters bank details can also export the full list, you have separated the decision but not the data. A complete roster of names, account numbers and IFSC codes is worth something on its own, and it walks out of the building as a spreadsheet attachment.

The fourth is what turns an argument into a fact. Six months later, "I approved that" and "no you did not" is unanswerable unless something wrote it down at the time.

How Shiftelio separates entering from approving

Shiftelio treats "Payment details" as a capability with three distinct permissions, not one: View the bank or UPI details staff get paid into, Add and edit them including in bulk, and Approve details somebody else entered. You hand those out separately. A manager who does the typing can be given the first two and not the third, and from that moment their work queues instead of applying.

Here is what that looks like in practice. A manager uploads a roster of forty people's bank details from a spreadsheet. Nothing is live. Forty rows land on the Payment approvals screen grouped as one upload, because forty separate Approve clicks is how a queue stops being read at all, and whoever holds approval rights confirms or rejects the whole upload in one decision. If one of those rows belongs to somebody who already has details waiting for a decision, the upload does not quietly overwrite them. It flags the conflict and asks for that one to be settled first.

Changing an account that is already approved behaves the same way when a manager does it. The record goes back to pending and needs confirming again, so an existing salary destination cannot move without a second person seeing it move. An owner's own entries are approved outright, which is the honest limit of this: it separates duties among your staff, not between you and yourself.

The part that is genuinely uncommon is the reading. When a manager exports the payment roster to work on it, account numbers, IFSC codes, UPI IDs, PAN, UAN and ESI numbers all come out masked as ****1234. The account holder's name is deliberately never masked, because a name paired with the wrong account is exactly the error you want visible at a glance. Leaving a masked cell untouched means "no change". Only the owner can export the roster in the clear, and when they do, that export is itself written into the history as an event with a timestamp. The list cannot be read in full by the person who maintains it, and the one person who can read it leaves a mark saying so.

Underneath, every touched row writes its previous value into a payment history table before it is overwritten, which is what makes an undo possible and what answers the six-months-later question. Nobody can edit or delete an entry in that history, and people who are allowed to see payment details can read it.

The employee is told too. Approve or reject their bank details and a notification goes to them in their own language, with the reason attached if it was a rejection. The person whose money it is finds out that something moved, which is a control in its own right and the cheapest one you own.

You can see where this sits alongside attendance, payroll and the rest on the features page.

What to do this week, whatever you use

None of this requires software to start.

The short version

The account number is the only part of payroll that decides where the money physically goes, and in most small businesses it is the part with the fewest controls on it. Two people on every change, a record of what the value used to be, and a message to the employee. That is the whole control, and none of it is expensive.