I received an invoice for Norton Antivirus in connection to Quickbooks but I never signed up for it?

I ended up googling the phone # provided in the email to verify it was a scam. It came from @notifications.intuit.com

I received one as well and the email came from 

@ notification . intuit . com

It seems that scammers are now using QBO to send invoice emails with the Norton logo to conduct a refund scam. 

I just received one today as well saying I was to be billed today $449.63 for Norton along with a pdf of the invoice.  Of course, I did not open it and I do not have Norton so knew it was phishing from the start.

I received this same email today too. Amount stated that was being charged for $459.45. Email came from quickbooks @ notification . intuit . com

Hello @concerned user1.

Thanks for sharing this information.

The security of your account and information is a top priority for Intuit. Any time you receive an email that you are suspicious about, you can always forward it to our security team here: security@intuit.com and they can review it.

Here’s some additional information about how to Identify suspicious activity, phishing scams, and potential fraud.

Never hesitate to reach out to the Community with questions about emails or anything else. We’re always here to help.

I have just received the same. I called the number on the invoice to get more information on the scam. A person with an Asian accent answered and provided to give me a website address (caresupport.cc) and a log in code where I would download and fill out additional information in order to get a "refund". I have no idea what information they were going to ask on the form, but I'm sure the download said "application" not as an application form but as an executable file. Bad, Intuit should force these people out...

I got it too.

Just to see what would happen, I hit reply and the reply address wasfigijons99309-at-outlook.com. I didn't send.

Maybe intuit can do something with this info.

Thanks for sharing this, @haikuandy.

Unfortunately, there are always going to be people who try to take advantage of any situation, and I'm glad you caught on.  @Mmassie shared some helpful information earlier in this thread, and any time you receive an email that you are suspicious about, you can always forward it to our security team here: security@intuit.com, and they can review it.

Thanks for being a part of the Community, I'm here if you have any additional concerns. 

I received an email like this on February 16, 2022.  Said the amount they were charging was $399.89.  I forwarded the email to Quickbooks Security.  Looked pretty official, but I knew I didn't order anything and checked bank accounts to make sure there were no charges.  argh!

I went through the supposed removing Norton from my computer but didn't go through the payment information. Would the phisher have gotten into my computer and taken information? He was in my computer for the removal process.

Hi there, Barbara75.

I can share some information on how you can protect yourself from email scams and other security risks.

The phisher can only obtain your personal information if you responded to emails asking for details about your account, password, banking, or credit card information. Additionally, it’s recommended to never open any attachments unless you both know the sender and you’re expecting an attachment from them.

After removing Norton from your computer, you'll want to report the email you've received to our security team so they can review it. You may go to Intuit Online Security Center and then select the Go to security notices section. Once done, click Report a suspicious email to file a report.

Lastly, I encourage reading this article to learn how to recognize official Intuit correspondence and websites: Identify suspicious activity, phishing scams, and potential fraud.

Keep me posted if you have any other concerns or further questions. Have a good one.

I received an email today. The email had an attachment, a PDF. I clicked on the PDF, which I don't think was downloaded. Do you think there could be an issue? Definitely not smart on my part. Is there anything I can do?

I received an email today. The email had an attachment, a PDF. I clicked on the PDF, which I don't think was downloaded. Do you think there could be an issue? Definitely not smart on my part. Is there anything I can do?

Let me share some action to take after receiving an unknown email, @Hbhatia.

If you suspect you have received a phishing email targeting the Intuit brand, proceed to the Intuit Online Security Center and click Go to security notices for further information. If you didn't encounter a similar email within the Security notices, choose the Report a suspicious email to file a report. This way, our security team can further check and investigate.

Moving forward, it is best practice to avoid opening any attachment unless you both know the sender and you’re expecting an attachment from them.

Additionally, you may also review this link: Identify suspicious activity, phishing scams, and potential fraud.

Don't hesitate to visit us again if you have questions with invoices or suspicious emails. I'll be around for you. Take care and have a great day ahead.

@Hbhatia 

Opening a downloaded PDF file should be fine as long as you didn't click any links there.

I had the same email - and amount! I called the phone number and the guy sounded so fake. He ended up hanging up on me. Don't these "people" have better things to do?!

---

@Alex_rocks wrote:

Don't these "people" have better things to do?!

---

That's what they do for a living 8p

I got the same thing and was panicking, but didn't see where any money was taken out of my account. 

SCAM

CLUE # 1 - Too many other recipients for an invoice.

CLUE # 2 - BILL TO user

CLUE # 3 - SALES TEAM Assam IN

CLUE # 4 - From: Sales Team <[email address removed]> Excessively long domain name that is not used by Intuit for billing.

CLUE # 5 - Reply-To: [email address removed]

They went the extra mile to create a PDF for invoice number 1004.  I am also sure Intuit invoice numbers are different/higher than 1004.  The "2 hour threat" is also a clue they count on a panic response.

Forwarded to '[email address removed]'

The question is how are scammers able to send mails from subdomains of yours? Are you not securing it up?

I received the same email I inadvertently opened the file attached… what should I do? 

Hi BizzyB,

Hope the email you received is not used for phishing activities. You can report it to our Security team so they can take action about it.

1. Go to this link; https://security.intuit.com/.
2. Click Contact Us.
3. Look for Report a fake email (or phishing email) and click on it.

As for your computer, we don't have control over it, so I suggest running a virus scan using your anti-virus or anti-malware software. You may also contact their support teams to know what you can do after accidentally opening the attachments.

Lastly, only trust emails from us with the domain intuit.com. I can see that ShiellaGraceA has shared good information about handling cases like this. You may refer to her response, as well.

Feel free to reach back out if you have other questions in mind.