← Support

What an alert means and what to do

An alert means a bank detail changed on a contact in Xero since the last check, or a new contact appeared with bank details already filled in. It might be entirely legitimate. It might not be. LedgerWatch tells you something changed. It doesn't tell you whether that's a problem. That part is on you.

What the email tells you

Which contact, which field changed, and when Xero recorded the change. It also lists any risk signals LedgerWatch noticed: the new account name not resembling the contact name, an unpaid bill currently owing to this supplier, or the change happening on a weekend or outside business hours. These are prompts to look closer, not proof that anything is wrong. Plenty of genuine changes trigger one of them.

For security, the email shows a masked version of the account details rather than the full number. If you need the full value, it's on the change log in your dashboard.

Verify before you pay

Don't reply to the email that requested the change, and don't call a phone number that came from the same changed contact record. If that record has been compromised, the number could be part of it. Instead, call the supplier on a number you already had on file before the change, or check the new details against a recent invoice or letterhead you already trust. If you're at all unsure, a small test payment first, or a call to your bank, is worth the delay.

Record what you found

Once you've checked, open the change log entry for that contact and set an outcome, so there's a record of the decision, not just the change itself. See Using the change log and triage outcomes.