Clear Stored Card Data and End QuickBooks Desktop's 90-Day Password Rule

A forced password that expires every 90 days can lock you out of a discontinued QuickBooks Desktop file; this guide removes that risk for good.

QuickBooks Desktop scans your company file for unencrypted card numbers. When the scan finds one, the program imposes a complex password on the administrator and expires that password every 90 days. On a supported install, a forgotten password is an annoyance. On a discontinued install it can end your access to the file. The requirement follows the data, so the data is where the work is.

Why does QuickBooks demand a new password every 90 days?

Intuit built Credit Card Protection into Desktop to satisfy payment-card industry rules. The scanner runs against the file itself, not against your license or your version. Whenever it matches a card-number pattern, the administrator, and any user who can see card data, must set a complex password and a challenge question.

The password then expires every 90 days, with advance warning before the deadline. Miss the change and the challenge question becomes the only way in. Wrong answers are limited; once they run out, the account stays locked. The vendor's automated reset tool serves recent releases only, so a discontinued version has no reset path through that channel at all.

Back up the file before you change anything

Make the backup while you still know the current password. A backup captures the password state as it stands, so access is the first thing to copy.

From the File menu, choose Back Up Company File and Create Local Backup, and leave the verification option selected. Store the resulting .qbb on separate media, not on the same disk as the live file. Our engineers add one more layer: use Create Copy from the File menu to duplicate the company file, then run Verify on the copy. That confirms the file is sound before any password work begins.

Finding the card numbers stored in the file

The detector matches number patterns, so card data hides in more places than the obvious ones. Work through three locations.

Customer profiles first. In the Customer Center, open each customer and check the payment settings tab, where a stored card number and expiry date can sit for years.

Transactions second. Sales receipts and payments from older releases often carry a card number in the payment area once the method is a card type. Legacy files are the usual culprits.

Free text third. Notes, memos, descriptions, and custom fields all get scanned, so a number typed into a memo triggers the rule just as surely as a real one. The Find window under the Edit menu can search memo and custom fields for digit runs.

Removing a stored number from a saved transaction changes no amounts. The audit trail simply records the edit.

Turn the rule off and set a password that lasts

Log out and reopen the file once the numbers are gone. Open the Company menu and choose Credit Card Protection. The wizard reports whether sensitive data remains, and a clean scan lets you switch protection off.

Then change the administrator password from the Set Up Users and Passwords area of the Company menu. With the rule lifted, a short password is accepted and the 90-day expiry stops applying. Every affected user repeats the change at next sign-in.

Confirm the result at the following login: no complexity demand, no expiry warning, no challenge question. A few very old builds keep the policy alive even after the data is gone. The remedy there is the same one a lockout calls for.

If the lockout already happened

An expired password and an exhausted challenge question leave the file shut. The automated reset tool will not serve a discontinued release, and time does not change that. A password removal performed directly on the company file restores the administrator account without touching a single transaction. That is the work our QuickBooks admin password recovery service does. The clearing procedure above then keeps the rule from returning.

Keeping the rule from coming back

Never type a full card number into any field again. If you still take card payments, run them through your processor and record only a reference in the file. Keep the last four digits in your processor's records rather than in the books.

Restoring an old backup can bring the data, and with it the rule. Check the Credit Card Protection status after any restore, and again after any bulk import. Revisit the file whenever someone new starts keying payments. Keep the pre-change backup offline as your fallback.