Controlling employee business debit cards safely

Employee business cards are useful only when permissions, limits and review are designed around the job. Giving several employees one shared card or one director login weakens accountability and makes fraud, mistakes and bookkeeping problems harder to investigate.

Issue individual cards with role-based limits

If three employees use the same physical card and PIN, a £780 transaction can become an argument about who made it. Named employee cards create a much cleaner record and can often have separate spending controls. The same principle applies to online banking users: individual logins are better than one shared director account.

Shared credentials also create an offboarding problem. Changing one employee should not require changing a password used by the whole finance team.

A field engineer who buys fuel and occasional parts may need a £500 daily card limit. A procurement manager may need £5,000. Giving both £10,000 “just in case” increases the amount that can be lost before anyone notices. Set the limit from expected spend plus a sensible buffer.

Review exceptions. If the engineer repeatedly needs temporary increases, the underlying purchasing process may need redesign. Temporary limits are often safer than permanently expanding authority for rare events.

Issue named cards instead of sharing one card or PIN. Tie each card to a job role, spending purpose and starting limit, then document who approved it. If a £2,000 monthly limit is unnecessary for a staff member who normally spends £150 on local deliveries, lower exposure to something closer to the real task.

Practical security drill: write a three-step response for employee business debit-card controls before an incident occurs. Step one is to stop the risky channel; step two is to contact the bank or provider through a known route; step three is to review changes and transactions. Note the exact time and keep screenshots or reference numbers. If a suspicious event happens at 14:10, a timestamped sequence is far more useful than remembering later that something happened “in the afternoon”, especially if several accounts or devices are involved.

Capture receipts and review spending while it is fresh

Requiring receipts at month-end creates detective work. Ask staff to capture them at the time of purchase or within a short defined period. Accounting integrations can help, but the policy matters more than the software.

If a £146.20 transaction appears on Tuesday and the employee uploads the receipt that afternoon, the finance team can classify it quickly. If the same transaction is questioned six weeks later, the employee may not remember whether it was tools, a hotel or a client expense.

Instant notifications can reveal unusual spending quickly, but monthly review should also look for patterns: repeated small purchases at the same merchant, weekend spending, cash withdrawals, subscriptions or transactions just below an approval threshold.

The aim is not to accuse staff based on one odd payment. It is to identify behaviour that needs explanation. A recurring £79 charge may be a legitimate software subscription that nobody cancelled after a project ended.

Require receipts while the transaction is still fresh. A same-day photo with merchant, date, amount and business purpose is easier to reconcile than a monthly chase. Use accounting tags or card notes where available, but keep the underlying receipt because a transaction description alone may not explain why the purchase was legitimate.

Use alerts, freezes and offboarding as daily controls

When a card is lost, the employee should know exactly who to contact and how to freeze it. When an employee leaves, remove cards, online-banking access, payment-app permissions and accounting integrations on the same day. Do not rely on collecting the plastic card alone.

Also review scheduled or recurring payments the employee created. A former marketing manager’s card can remain attached to advertising platforms and continue charging after the person has left.

Even a trustworthy employee can be tricked by a fake supplier email or invoice. Card controls should therefore sit alongside beneficiary verification and invoice approval. A spending limit reduces loss, but it does not prove the merchant or supplier is genuine.

For higher-risk payments, require a second person to confirm the commercial purpose or supplier change. Strong controls protect employees as well as the business because no single person carries the whole decision.

Use alerts to look for patterns as well as single large payments: repeated small purchases, unusual weekend spending, unfamiliar merchants or transactions just below an approval threshold. A sensible control process asks about anomalies early without treating every employee card payment as suspected fraud.

Practical security drill: write a three-step response for employee business debit-card controls before an incident occurs. Step one is to stop the risky channel; step two is to contact the bank or provider through a known route; step three is to review changes and transactions. Note the exact time and keep screenshots or reference numbers. If a suspicious event happens at 14:12, a timestamped sequence is far more useful than remembering later that something happened “in the afternoon”, especially if several accounts or devices are involved.

Separate employee misuse from supplier or card fraud

Should employees share the director’s business debit card?

It is usually better to issue named employee cards or individual access where available so transactions can be attributed and permissions managed.

How low should an employee card limit be?

Low enough to limit loss but high enough for normal work. Base it on the role’s typical spend and use temporary increases for exceptional purchases.

What happens when an employee leaves?

Cancel cards and digital access promptly, then review recurring payments, saved merchant cards and approvals linked to that user.

Offboarding should freeze or cancel the card on the employee departure date, remove app access, recover physical cards and review recent spending. Keep supplier fraud separate from employee misuse; if a legitimate employee paid a fraudulent invoice, the investigation and recovery route is different from unauthorised personal use.

Practical security drill: write a three-step response for employee business debit-card controls before an incident occurs. Step one is to stop the risky channel; step two is to contact the bank or provider through a known route; step three is to review changes and transactions. Note the exact time and keep screenshots or reference numbers. If a suspicious event happens at 14:13, a timestamped sequence is far more useful than remembering later that something happened “in the afternoon”, especially if several accounts or devices are involved.

Sources and verification

• Business.gov.uk - Getting a business bank account
• Charity Commission - Internal financial controls for charities

MyBankAnswers uses official provider and UK regulatory sources wherever practical. Information is general and does not constitute financial advice.