Fake QuickBooks Feedback Email Scam: Protect Your Account Access
Phishing emails dressed as QuickBooks customer feedback requests are being used to steal sign-in details. Learn how the scam works and how to respond.
A phishing campaign flagged by the email security firm MailGuard dresses itself up as a QuickBooks customer feedback request. The goal is not your opinion. It is your sign-in details, and with them unauthorised access to your account. Here is what the pattern looks like, and how we recommend responding.
How does the fake feedback email work?
The message arrives looking like a routine request for feedback about QuickBooks. That framing is deliberate: surveys feel low-stakes, so people click without much thought. In campaigns like this, the link typically leads to a counterfeit sign-in page built to resemble the real one. Anyone who signs in there is not logging in at all. They are handing their credentials straight to the attackers.
Who is at risk?
Any business or accountant with a QuickBooks Online sign-in is a potential target. Phishing of this kind is rarely personal; the sender usually works from a bought or scraped list. Bookkeepers and firms managing several client files carry extra exposure. One stolen password can open the door to more than one company’s financial records.
What can an attacker do with your account?
A QuickBooks account is a rich prize. Depending on your setup it can hold customer and supplier records, invoice history, bank details and payroll data. An intruder can read all of it. They can also trade on your good name: an invoice sent from a real account looks legitimate, which makes it effective cover for the next fraud.
How do you spot a fake feedback email?
Start with one rule: a genuine feedback request never needs your password. If clicking a link brings up a sign-in page, that alone is a red flag. Check where a link really goes before opening it, by hovering over it on a desktop or pressing and holding on a phone. An address outside Intuit’s own domains means the message is hostile. Generic greetings and artificial urgency are supporting clues, not the main test.
What should you do if you already signed in?
Act quickly. Change your password from a device you trust, reaching the sign-in page by typing the address yourself rather than clicking a link. Turn on multifactor authentication if it is not already active. Then review recent account activity: look for unfamiliar users, changed contact details, or bank and payment changes you did not make. If your firm manages client files, tell affected clients promptly so they can watch for suspicious invoices sent in their name.
Getting ahead of the next attempt
Security is cheaper before an incident than after one. Use a unique password for your QuickBooks sign-in and reuse it nowhere else. Keep multifactor authentication on for every user in the company file. Walk your team through the feedback-email scam, because a campaign only needs one person on one busy afternoon. A short conversation today can save weeks of cleanup later.