Scammers Drained a Business Bank Account Through QuickBooks: What to Do
Fraudsters can use QuickBooks-related phishing and fake payment alerts to drain small-business accounts. Here is how it happens and the practical steps to
When a Louisville business owner recently discovered that scammers had drained his account down to 44 cents, it put a spotlight on a growing threat facing small businesses: fraud that exploits accounting and payment workflows. While the details of each case vary, the pattern is familiar to many QuickBooks users.
How scammers target QuickBooks users
Most attacks do not involve hacking your QuickBooks file directly. Instead, fraudsters rely on deception:
- Fake payment confirmations. You receive an email that looks like a QuickBooks or Intuit notification saying a customer paid an invoice. The email contains a link or phone number for “support.”
- Phishing login pages. A realistic-looking email asks you to verify your QuickBooks credentials. If you enter them, the attacker captures your username and password.
- Bank or routing detail changes. A scammer posing as a vendor asks you to update their payment information in QuickBooks, redirecting legitimate payments to a fraudulent account.
- Refund and overpayment schemes. A “customer” claims they overpaid and asks you to send back the difference before the original payment is discovered to be fraudulent.
Practical steps to protect your accounts
A few habits go a long way toward preventing these losses:
- Verify any payment-detail change by phone. If a vendor emails new banking instructions, call them at a number you already have on file — not the number in the email.
- Turn on two-factor authentication. This blocks attackers even if they obtain your QuickBooks password.
- Check the sender address. Official Intuit emails come from
intuit.comdomains. Hover over links before clicking, and never enter credentials from an email link. - Reconcile accounts regularly. Catching unauthorized transactions early improves the chances of recovery.
- Limit user permissions. Not every employee needs access to banking details or the ability to change vendor payment information.
If your account has already been hit
Speed matters. Contact your bank immediately and request a recall or reversal of the fraudulent transfer. Change your QuickBooks and email passwords right away, and review your vendor and employee lists for any unauthorized changes to payment information. If you need help auditing your file for altered routing or account numbers, professional QuickBooks data services can assist with a review of your company data.