The issue happened again several users in my company got some phishing emails coming directly from "__quickbooks @ notification. intuit.com"
The following information was in the email along with an attachment.
The invoice is now paid.
------------------------ Sales Receipt Summary ---------------
------------
Receipt # :
Receipt Date: 4/7/2023 6:30:42 a.m.
Total: 12,525.00
The complete version has been provided as an attachment to this
email.