Fake QuickBooks Payment Confirmation Emails Target Businesses

A phishing campaign disguised as QuickBooks payment confirmations is targeting small-business owners and accounting teams. Security researchers at MailGuard identified the scam, which uses realistic-looking invoices and payment receipts to trick recipients into handing over credentials or downloading malware.

How the phishing email works

The fraudulent messages are designed to look like routine payment notifications. They typically mimic standard QuickBooks branding and formatting, referencing fake invoice numbers or payment amounts. The goal is to exploit the daily reality of business operations: when an email arrives stating a payment has been processed, busy staff are more likely to click quickly to verify the details.

These emails usually contain a call to action, such as a button to view the invoice, download a receipt, or log in to an account. Clicking these links redirects the user to a credential-harvesting page or prompts a malicious file download.

Red flags to watch for

Because the emails are visually convincing, identifying them requires a closer look at the details:

• Sender address: Check the actual “from” address, not just the display name. Phishing emails often use spoofed or slightly misspelled domains.
• Urgency and pressure: Scams rely on urgency. Be wary of language demanding immediate action or threatening account suspension.
• Link destinations: Hover over any link before clicking to preview the URL. If it does not point to an official QuickBooks or Intuit domain, do not click it.
• Unexpected payments: If an email confirms a payment you were not expecting or does not reference a specific, recognizable client, treat it with suspicion.

Practical next steps for your business

If you receive a suspicious payment confirmation, do not click any links or download attachments. Delete the email or report it to your IT department or email provider. To verify whether a payment actually came through, open your QuickBooks application directly or log in independently through your browser rather than using the link provided in the email.