QuickBooks Phishing Scam Hides Behind Fake Customer Feedback Email

Email security firm MailGuard has reported a phishing campaign dressed as a QuickBooks customer feedback request. The message invites you to share your opinion. The link inside does not open a survey. It opens a counterfeit sign-in page, and anyone who logs in there hands over the keys to their account.

How does the fake feedback email work?

The lure unfolds in two steps. An email arrives that looks like a routine request for your opinion about the software. It offers a link or button to begin.

That destination is the trap. Instead of a survey, the link leads to a page built to imitate a real sign-in screen. Enter your user ID and password there, and the details travel straight to the people behind the campaign. They can then access the account as you, often quietly, until money or data moves.

Which warning signs give the email away?

Nearly every version of this lure shows at least one of these tells:

• It arrives unannounced. A feedback request you never expected deserves suspicion before anything else.
• The sender address is wrong. Read the full address, not the display name. Anything that is not an official Intuit domain is a giveaway.
• A password comes first. A real survey lets you answer questions; it does not require credentials to start.
• The link points somewhere odd. Hover over it and read the destination. Phishing links often resolve to domains with no connection to Intuit.
• Pressure or bait. A promised reward, or a deadline measured in hours, exists to make you click before you think.

What should you do when the email arrives?

Do not click. Report the message as phishing in your mail client if the option exists, then delete it. If colleagues received it too, send a short warning describing what it looks like. A scam someone has described to you is much harder to fall for.

What if you already signed in on the fake page?

Act fast, and in this order:

1. Change the password from a trusted device, typing the Intuit account address by hand rather than following any link.
2. Review recent sign-in activity in the account settings and end any session you do not recognise.
3. Switch on multifactor authentication if it is not already active, so a stolen password alone cannot open the account.
4. Check for unfamiliar users, altered bank or payroll details, and transactions you did not authorise.
5. Tell your bank if payment information is stored in the account, and keep watching statements afterward.

Help for a damaged or locked company file

We are an independent QuickBooks data service, not part of Intuit. If an intrusion leaves a company file damaged, encrypted, or locked, our engineers can assess it and recover what is recoverable. See our QuickBooks data recovery service for what that involves.

The habits that keep the next one out

Attacks like this fail at a single point: the click. Make it a standing rule that login pages are reached only by typing the address or using a saved bookmark. Treat every emailed link to a sign-in page as hostile, even when the message looks routine. Multifactor authentication is the second lock, and it costs nothing to turn on.

Start there today. Switch it on, then spend five minutes walking your team through this fake feedback email. Recognised scams rarely get a second victim.