QuickBooks Scam Email: How to Spot a Fake Intuit Invoice or Support Call

What should I do right now if I clicked a QuickBooks scam email?

Stop and keep the evidence. Don’t delete the email, because IT will want the headers and the link. What you do next depends on how far it went. Clicked only? Close the tab. Typed a password? Change it from another device. Let someone onto the computer? Unplug it from the network and call IT before anything else.

Here’s the order we’d work it in:

1. Remote access given to a “support agent”: pull the network cable or turn off Wi-Fi on that computer. Don’t shut it down and don’t wipe it. Call your IT people. Assume anything that computer could reach was exposed, including saved browser passwords and the bank portal.
2. Password typed into a sign-in page: from a different, clean device, change your Intuit password. Then change it anywhere else you used the same one. Turn on multi-factor authentication if it isn’t on already.
3. Card or bank details given: call your bank or card issuer on the number printed on your card.
4. Report it. Forward the email to Intuit at security@intuit.com, file at ReportFraud.ftc.gov, and file with the FBI at ic3.gov if money moved.

Intuit’s own guidance on suspicious activity and phishing says the same things for a clicked link: change your password, turn on MFA or a passkey, review account activity, run antivirus, and contact Intuit Support if you see transactions you didn’t make. The FTC’s tech support scam page adds the step people forget: if you reused that password anywhere else, change it there too.

What do QuickBooks scam emails look like?

They usually take one of three shapes, and all three want you to act before you think. One is a fake invoice or receipt for something you never bought, with a “Pay now” or “View invoice” button. Another says your payment failed or your card was declined. The third says your account is suspended or about to be closed.

Intuit lists the warning signs: a misspelled or altered sender address, a generic greeting, attachments you didn’t expect, requests for passwords or verification codes, poor grammar, and urgent lines like “Immediate action required.” Intuit says it will never ask for your password, sign-in details, or banking information by email. It also says it will never email you a “software update” or “software download” attachment. Any email that asks you to install something is fake.

A lot of these don’t even want a click. They want a call. The invoice says you’ve been charged for antivirus or a subscription, and there’s a number to call to cancel it. The person who answers is the scammer.

Can a scam email really come from intuit.com?

Yes, and that’s the part that trips people up. Intuit says its emails come from addresses that end in @intuit.com. That’s true, but it doesn’t prove the email is safe. QuickBooks sends invoices on behalf of whatever business sends them. An Intuit staff answer says invoices go out from quickbooks@notification.intuit.com by default. Anyone with a QuickBooks account can send one, and a criminal can open an account like anyone else.

So the sender address tells you which system sent it, not who’s behind it. The real test is simpler: do you know this vendor, and did you expect this bill? If not, don’t pay it and don’t call the number on it. If it’s a vendor you do work with, call them on a number you already had. We walk through that callback in how to verify wire instructions. It works the same way for a changed bank account on a vendor invoice.

How do I tell a real QuickBooks support call from a fake one?

Hang up and call back on a number you found yourself. Intuit’s community team says a real call is one where you called them, or they’re following up on something you already asked for. In its post on verifying support calls, real support never asks for your password or a one-time code. It never asks you to pay with gift cards, wire transfers, or crypto. And it doesn’t install remote-access software unless you started the request.

To reach real support, use the Help menu inside QuickBooks, or type quickbooks.intuit.com into the browser yourself. Don’t search for “QuickBooks support number” and call the first result. Criminals buy search ads that impersonate brands, the FBI warned in December 2022. We cover that trick in malvertising and fake software downloads.

The fake support call does the most damage, because it ends with a stranger in control of a computer that has your books open. The FBI’s advice on tech support scams is blunt: never let someone who contacted you take control of your computer, and never call a number from a pop-up, text, or email.

Why does this matter more for CPA firms?

An accountant’s computer isn’t one company’s books. It’s dozens. Staff at an accounting firm are often signed in to client QuickBooks files, the tax software, and the client portal all at once. A fake support agent on that screen, or a stolen Intuit password with no MFA, can reach client financial data at every one of them.

That’s customer information under the FTC Safeguards Rule. If a breach involves at least 500 consumers, the rule requires notice to the FTC within 30 days of discovery. We cover that in the GLBA Safeguards Rule for small firms. It’s also where a “check your QuickBooks payment” email turns into business email compromise: someone reads your threads and sends your clients new payment instructions.

What controls stop QuickBooks scam emails?

No filter catches all of them, especially the ones sent through Intuit’s own system. The controls that matter are the ones that limit what a click or a phone call can do.

• Enforced MFA on Intuit and email accounts. A stolen password alone shouldn’t be enough to sign in. Phishing-resistant MFA goes further, because a fake sign-in page can’t relay it.
• EDR on every machine. If someone installs a remote-access tool, endpoint detection and response is how you see it and cut it off. See EDR vs. antivirus. It’s part of our managed IT and security baseline.
• No local admin rights for daily work. It’s harder for a caller to install software on an account that can’t install software.
• A written callback rule. No vendor bank change or “past due” payment goes out without a call to a number you already had.
• An incident response plan people can find. The first ten minutes go better when someone already decided who unplugs what. Start from our incident response plan template.
• A five-minute talk with staff about the three shapes above, and the rule that real Intuit support doesn’t call out of the blue.

If the email came as a fake e-signature request instead of an invoice, the same rules apply. See our guide to the fake DocuSign email.

Key takeaways

What this looks like when we do it

On our managed IT and security baseline, MFA is enforced on Microsoft 365, not left optional. Every machine runs EDR and is monitored. When someone calls about a suspicious email or a caller who got onto their screen, critical issues get a response in under 15 minutes. We isolate the machine, reset the accounts from a clean device, and look for persistence before anyone goes back to work.

For CPA firms, we also keep the Safeguards Rule paperwork current, so an incident like this gets logged, reviewed, and documented the way the rule expects. We also handle day-to-day QuickBooks problems, like the Intuit ID login hang we wrote up. That way staff call us first, not a number from a search result.

If your team gets these emails and you aren’t sure what would happen after a click, book a call and we’ll walk through it.