After contacting support, I've been receiving a lot of specific phishing emails.- is overseas support selling info?

Photoguy · ‎February 11, 2023

For the last 2-3 weeks I have been getting a lot of phishing emails with the subject line of "Quick Books Bill Copy" which tell me that I am getting charged for a subscription for Quickbooks Desktop Pro and to contact them if this is in error. Of course, the email address is fake (Russian), as is the phone number. I won't post the number because I don't want search engines to somehow make it appear legitimate.

The grammar is poor as expected - for instance it calls the product Quick Books. This is the main body of the email followed by a fake invoice:

This is a notification Mail For Your Purchase With Intuit For Quick Books Desktop Pro 2023 For your Pc and you paid $1XXXXX.00 USD. To Intuit LLC Please Review Your Bill Details Below:-

Here is the scary part: I ONLY started getting these emails after I contacted tech support regarding upgrading my Quickbooks Desktop Pro software in order to continue to use my payroll subscription. I have posted about that several times already in other threads but ultimiately was told it'd be an extra $549 a YEAR plus my regular subscription or I would have to move to QBO. I thought that was just too expensive and cancelled my payroll subscription all together, even though I'm still waiting for Intuit to remove my credit card information (see other thread)...but I digress.

The tech support person I spoke with was clearly overseas somewhere. Their English was so poor that I doubt it was the philippines. Judging by their manorisms it sounded like an Indian call center and they seemed a little peeved that they did not make the $549 sale and kept saying that the only way to get it was through them. I explained that it was just too much for a small business and did not want to go to Quickbooks Online, but they were just weird about the whole thing.

So now I'm worried about what information about my account did they have access to through chat? I was logged into my account so at a minimum they knew my email address. Did they know my company name, phone number, address, or financial information too? What would stop an employee likely working from an insecure call center or from their home from writing down my email address and what I was looking for and selling that information to scam call centers or scammers that send mass emails?

Again, up till the time I contacted support, nobody on earth would have guessed that I was looking into updating to QBD2023. I use different email addresses for company stuff. For instance, right now I use a personal account for this forum. I NEVER use my business email for anything other than customers.

The other scary part is that while googling the contents of the email, I found NOTHING so now I have to wonder whether this is a targeted attack by that tech support person. How do I even report this to Intuit? They have the foxes guarding the hens! There is no official reporting mechanism in place. Has anybody else been getting emails?

DivinaMercy_N · ‎February 11, 2023

Hi there, @Photoguy. I want to ensure this will be taken care of.

Thanks for providing detailed information about your concern. Emails from Intuit always come from an email address with the domain @intuit.com. To easily identify them, you can check this article for the list of official email communication from us: Official email communication from Intuit Payments.

To ensure your safety, I recommend do not open any email message you suspect to be a scam. That said, you can report this to our security team. I'll guide you on how:

Navigate to the Online Security Center page.
Click Contact Us.
Look for Report a fake email and then click on it.

For reference, please read this article: Identify suspicious activity, phishing scams, and potential fraud.

You can also check our security notices for information on suspicious emails reported by other Intuit customers.

Additionally, to make sure you'll be able to contact the correct phone support team to avoid scams, please use the following links:

I'll be always here ready to lend a hand if you have any other concerns about accessing your account. Have a good one and stay safe.

View solution in original post

DivinaMercy_N · ‎February 11, 2023

Hi there, @Photoguy. I want to ensure this will be taken care of.

Thanks for providing detailed information about your concern. Emails from Intuit always come from an email address with the domain @intuit.com. To easily identify them, you can check this article for the list of official email communication from us: Official email communication from Intuit Payments.

To ensure your safety, I recommend do not open any email message you suspect to be a scam. That said, you can report this to our security team. I'll guide you on how:

Navigate to the Online Security Center page.
Click Contact Us.
Look for Report a fake email and then click on it.

For reference, please read this article: Identify suspicious activity, phishing scams, and potential fraud.

You can also check our security notices for information on suspicious emails reported by other Intuit customers.

Additionally, to make sure you'll be able to contact the correct phone support team to avoid scams, please use the following links:

I'll be always here ready to lend a hand if you have any other concerns about accessing your account. Have a good one and stay safe.

Photoguy · ‎February 14, 2023

I did email them. As expected, they did nothing.

Photoguy · ‎February 15, 2023

And again, it's VERY disturbing that the overseas sales people also moonlight as scammers and save private information.

pleasegiveusanemail · ‎December 13, 2023

I just want to chime in here and note this doesn't qualify as a solution. Are you insane? That's such a terrifying accusation, and you responded with steps to reach customer support! That is not a solution.

4Gal · ‎December 13, 2023

As long as their policies continue to allow support personnel to access customer databases anywhere, this problem will always recur. Don't expect too much.

Photoguy · ‎December 15, 2023

There are a lot of videos on youtube such as scambaiter which dive into the world of scam call centers in India and the common theme among them is that during the day, they all operate as legitimate call centers for US companies and then after closing, the scam people come and use the exact same office building or even computers to try to scam people. It's so easy for the Indian employees there who have very little if any accountability to American privacy laws to look at the customers' information and jot down their Federal Tax ID number, address, name of the owner, etc. and use that information when they switch to being scammers that night.

In my case, I continued to get the scam emails about renewing to Quickbooks Desktop 2023 right up till a month after my payroll had already expired and support had ended for my Quickbooks 2020. Then magically, the scam emails stopped so to me, this confirms that it was the Intuit employees (or likely scammer 3rd parties Intuit hires) are themselves the scammers because they knew exactly what product I was using and when it was going to expire. To me it's insane to use Quickbooks online when Intuit hires those kind of people because then they can get the keys to the entire kingdom and completely exploit your business's good name. This past year we also had a case where someone had filed for unemployment on behalf of our business's owner. We immediately reported it to the state and stopped it but it wouldn't surprise me if Intuit's employees were involved in that as well.

If anybody is reading this and thinking about doing manual payroll and stopping their Quickbooks subscription, it's really not hard. I've saved about $1400 by not getting Quickbooks Desktop 2023 and subscribing to payroll and don't miss a thing. Just gotta be a little more careful about typing in the numbers instead of them being generated.

Topics

Training

Community

Resources

After contacting support, I've been receiving a lot of specific phishing emails.- is overseas support selling info?