QuickBooks Phishing Alert: The Fake Customer Feedback Email
A phishing email tells QuickBooks users a customer left negative feedback. Learn how the lure works, the warning signs, and what to do after a click.
A phishing campaign is making the rounds among small businesses that use QuickBooks. The email carries an unsettling subject line: a customer has provided negative feedback on your services. It urges you to click through and read the complaint. The link is the real payload, and it wants your Intuit sign-in details.
What does the scam email look like?
The subject line is built to sting. A customer has complained, the message implies, and your reputation is on the line. Inside, you typically find a short body and a button inviting you to view the feedback or respond to it.
Campaigns built on this lure tend to share a few tells. The greeting is generic. The sender address does not belong to an Intuit domain. Hovering over the link exposes a destination that has nothing to do with QuickBooks. And the message presses you to act immediately, before you have time to think.
The psychology behind a fake complaint
Invoice scams work because money is at stake. This one works because pride is. A negative review feels personal, urgent, and fixable, so the instinct is to click first and read the complaint right away.
Attackers count on that reflex. Most owners will move to defend their reputation before they double-check a sender address. The email only has to fool you for the length of one click.
What happens after the click?
The link usually leads to a page dressed up as an Intuit sign-in screen. You enter your credentials, the page records them, and you are bounced to somewhere harmless so nothing seems wrong.
With those details, an attacker can enter your account, browse your books, and impersonate you. One common follow-on is invoice fraud: real invoices sent from your account, with payment details quietly swapped for the scammer’s own.
Handling the email safely
Do not click anything in the message. Hover over the link to see where it truly goes, and read the sender’s full address rather than the display name.
If you want to know whether real feedback exists, open a fresh browser tab and sign in the way you normally would. Our rule of thumb stands: a link inside an email is never the way into your accounts.
Report the message as phishing in your mail client, then delete it. If staff handle mail for your business, show them what the lure looks like so they can recognize it too.
What if you already clicked?
Act quickly and in this order. Change your Intuit account password from a device you trust, then switch on multi-factor authentication if it is not already active.
Next, review the account’s recent sign-in activity and its user list, looking for additions or changes you did not make. Scan recent invoices for altered bank details, and keep watch over linked bank and card statements in the weeks that follow.
If invoices were tampered with, tell affected customers promptly. A short warning before they pay beats a long apology afterward.
A habit worth building
Treat any email about your reputation as unverified until you have checked it inside the product. Type the address yourself, sign in, and look for the feedback there. If it exists, you will find it. If it does not, you just deleted a scam instead of feeding one.