Could you please confirm whether or not this email about Norton's makes sense? Does quickbooks bill for Norton services? There aren't any security notices regarding Norton, but a lot of people here seem to be having an issue. Could you provide an answer as to whether or not it's legitimate and if it is not legitimate: how did this happen? Why are we receiving spam from an "@...intuit.com" domain? Has Quickbooks been compromised?

Thanks for letting us know that you also received a suspicious email, @mbobcek. I'll make sure you get the best support available who can investigate this matter accordingly and provide you with the appropriate details you need.

Suspicious email is sometimes a scam to get you to provide personal information. These scams come in a variety of forms, but they all look pretty convincing. If you're not sure whether an email came from Intuit, look for the following signs:

• We’ll never ask for your personal info in an email.
• Our emails will always come from an email address that ends with @intuit.com. This includes @e.intuit.com.
• Any link we send you in an email will always be for an intuit.com address.

If you receive an Intuit email you aren't sure about, see our security notices for details of suspicious emails reported by other customers. Also, I encourage you to report the fraudulent activity to our Intuit Security team by sending an email to spoof@intuit.com.

Since the Community is a public forum, we'll need to collect some personal information to pull up your account. I suggest reaching out to our Customer Care Team. They have all the necessary tools to investigate this further. 

Additionally, I suggest browsing this article for you to easily recognize official Intuit correspondence and websites: Identify Suspicious Activity, Phishing Scams, and Potential Fraud.

I'm also including this article to learn more about how we handle your company's information and keep it secure: Privacy and security in QuickBooks. It also has other links related to security, which provide you with tips on this matter. 

Please know that I'm just a reply away if you have any other questions about this concern, @mbobcek. I'd be pleased to help you out. Have a good one!

We just got one also, so it seems they are going after non-profits as well as individuals. $489.35 it says but the return email is: 

Norton Billing 

quickbooks @ notification.intuit.com

and the phone number listed is: Regards
James D.
Norton Protection
[removed]

Thanks for joining this thread, @GuineaPigSanctuary.

Being able to prevent fraudulent activities is what we aim for our customers. With this, we want you to be protected over the emails or contacts that are suspicious.

Intuit doesn't ask for any personal information from our customers through email or from any written documents. So if you get these kind of messages, I do suggest that you follow Kevin_C's suggestions.

Also, contacting our Live Support to report this problem is recommended. This way our agents can log the name and email of the source.

To get our support, enter your contact information and connect with our Team by following the steps below in your QuickBooks Online account:

1. Go to the Help menu in QuickBooks, then choose the Search tab.
2. At the bottom click on Contact us.
   
3. Enter the keyword Account Management and Billing in the What can we help you with? box.
   
4. On the next screen, scroll down to How would you like to connect with us section.
5. Choose Chat with us to initiate a discussion with a live agent.
   
6. Enter you account contact information then press Get a chat.
   
7. When using this option, make sure to enable pop-up windows. The chat box will appear at the bottom right section of your monitor, and an agent will be with you shortly after. See this:

I want to make sure you're taken care of, please come back here anytime for additional help. I'll be right here if you need further assistance with any tasks in QuickBooks.

> Our emails will always come from an email address that ends with @intuit.com. This includes @e.intuit.com.

I just opened an email from "Norton Lifelock <[email address removed]>", saying "DUE 04/08/2022
$298.99" to someone named "Ray Yan" which is not anywhere near my name.

Since I've never had Norton Lifelock and that's not my name, I know it's a spoof email.

However, the email address in the "From" field looks legit according to your statement; if a legit intuit.com email is @e.intuit.com, why wouldn't @notification.intuit.com also be legit? "intuit.com" is the domain name, and "e" and "notification" are sub-domains as far as I know, due to be separated by the period before the domain name. Did something about web domain rules change to make this not true for intuit.com?

Anyway, either your explanation needs something additional explained, or it's not quite accurate. Can you please clear this up? If something looks legit according to Intuit's own explanation, then people are still going to get fooled, and at that point Intuit may be partially responsible for that.

Thank you for letting us know by reaching out to the Community. I’ll point you in the right direction for help.

We make sure that our customers are safe from any fraudulent activity. That is to say, if you want to double-check your concerns about emails you received from suspicious people, I recommend contacting our Technical Support team. They can pull up your account in a secure environment.

Also, our phone representatives have tools that can access your account if necessary to reinvestigate the email.

Here’s how to get in touch with them:

1. Go to the (?) Help icon in your QuickBooks Online (QBO) account.
2. Select the Search tab, and click Contact Us.
3. Enter a brief discussion of your concern and click Continue.
4. Select either Chat with us (if you preferred messaging) or Give us a call.

Please ensure to review their support hours to know when agents are available. This way, you can contact them at a time that is convenient for you.

Please know that if you have any further inquiries concerning this matter, I'm only a reply away. I'd be delighted to assist you. Have a good day!

I received one of these emails this morning.  I was really upset and found the phone number so I called.  I talked with someone that said he could show me how to void that out.  This is the first time I have ever had anything like this happen so I was letting him talk me through until we got to the point I finally decided he was having me setup my computer so they could access it.  At that point I told him he was full of sh.t and hung up.  They are really digging deep because my account has been inactive for several years.  There wouldn't have been any financial information there for them to utilize.  I forwarded the email to support and had tried to send it to the [email address removed] but it came back as undeliverable.

I was happy to find this and that I'm not the only one that was subject to these people.  Thanks for being here to help.

Jan

Thanks for joining this thread, jnrbnkng.

I'm happy to hear the information provided by my colleagues was able to help with submitting a report about the suspicious email you received.

Here's some ways you can help protect yourself from phishing attacks:

• Never share your passwords.
• Install antivirus software and keep it up-to-date.
• Make sure you use a modern browser and keep it up-to-date.
• Always use strong passwords on your computer and Intuit-based accounts.
• Don't respond to any emails asking for details about your Intuit account(s), password(s), banking details, credit card information, etc.
• Keep your operating system and any critical programs up-to-date with their latest patches. These updates are frequently security-related.
• When it comes to email attachments, it's best to never open them unless you know the sender and were also expecting an emailed attachment from them.

You can find more useful security tips in the Online security tips section of our Intuit Online Security Center.

I'll be here to help if there's any questions. Have a great day!

You didn't read what I wrote and just sent a boilerplate response.

Send my original post to your manager.

There's a problem with your site's recommendations about recognizing spoof emails, which is making them look legit to customers.

Your site's recommendations are literally telling people spoofs under certain circumstances are legit.

Hello there.

Security and keeping your account safe is one of our top priorities here in the Community. Let me share additional information about the most common email address that we used in sending email notifications to you. 

We can report phishing emails through this link: http://security.intuit.com. This is where Intuit's security team posts information about SPAM and Phishing email attempts. Once you're in, you'll have to the Report an Issue tab and click the Report a suspicious E-mail link from the Report an Issue section. Then, enter the necessary information and click the Submit button when you're done.

Additionally, you can also read this article to learn about the many email addresses we use to connect with our customers and forward any questionable emails to Intuit for review: Is this email I received a legitimate communication from Intuit.

In case you receive Intuit email you aren't sure about, please see our security notices for details of suspicious emails reported by other customers. 

Additionally, I've included these articles  on how to protect your account and how we keep your data secure: 

• How To Recognize And Report Suspicious Emails
• How We Keep Your Data Safe

Let me know in the comment section if you have further concerns about reporting suspicious emails. I'll be more than happy to help. Have a nice day.

My mom got an email like this, also from [email address removed]. Sadly she was scammed out of a lot of money. I asked her to forward the email to you.

Christi

Folks, the problem is that you are not verifying the people who are allowed to raise such invoices. It appears that anyone could use your services and send invoices to random people. How are you ensuring that the people who are raising these invoices are running legitimate businesses?

[screenshots removed due to PII]

You missed the point. The email had a legit intuit domain name. Of course, I can't show people that because you remove it from the post, so... I don't know, is Intuit part of this scam?

The scammers used a QBO account to generate and send the invoices to their victims for their scam

Just an update--I just received the same kind of email last week--it is a scam.  On the same day I received a genuine Email from Norton advertising an upgrade.  Here is the difference.  Look at the email address.  Norton comes from secure.norton.com.  The fake uses a norton logo but the email is from quickbooks @notification.intuit.com  Norton does not used intuit to send bills.  Also my existing subscription had not yet expired and was not due for months.

Right now I am receiving many scam Email saying I owe for an invoice.  I even got one that said it was trying to pay me.  They copied a company we do receive Email payments from, but again the details of the Email were incorrect.  Follow your gut!  If it looks wrong, it probably is!

That is not a difference @Buckhenry.
It's very normal for companies to use a different service for email marketing and email updates than they do for sending receipts. Especially as quickbooks is a billing tool it makes sense that a service as Norton would leave that to a 3rd party.

Add to that, that the scammers are using an Actual subdomain of intuit (@notifications.intuit.com) and not just some random email and to the untrained eye it all looks very convincing. I work in IT and eventhough I thought it weird instantly, it still had me go and google it since intuit was a known name for me. Intuit needs to look into this further instead of just posting copy paste replies and asking for more info in private deeper level support.

I will not contact you with further information as further information should not be needed and, any request to do so will be ignored.

It would also do you well to Sticky something to the top of this post about this being a fraudulent attempt instead of letting people that want to find out sift through a whole topic first.

Best regards.

Hello. I have received an email as well. They said that my Norton was renewed and gave a number to call in order to cancel. They are Indian people who does not even know what they are saying or doing. So unprofessional even for trying to trick people. They keep asking us to download things or go to browser. Be careful. 

This is definitely a scam.  They signed up for a quickbooks account and have been using their well optimized transactional email platform to avoid spam boxes, and the Quickbooks/Intuit brand and domain to give it all legitimacy.  I’m sad to see this has been going on for months and that Intuit isn’t posting that they have a handle on it (or believe it’s a problem).  We have also reported this.

Got this too. Have to say one of the most insidious phish emails I've received. Return address looks like an official Intuit address. PDF of invoice, links to privacy policy, etc... Only falls apart when it provides phone number, address and email in the middle of the body. 

The phone number is for the "National Quotation Bureau" in Tuxedo Park, NY. The address is for a parking lot in Fresno, CA and the email address has an aol.com domain.

Definitely something phishy going here...

Another community member shared a very informative article as our reference for identifying scams

https:// cpaagi.com/beware-of-quickbooks-payment-scams/

What I think is being missed here is that Intuit's own anti-scam recommendations say that if the FROM email looks legit, it's legit. The examples I've given for these provable scams show a legit-looking FROM email, and Intuit's support is either oblivious to what we're saying, or is part of the scam.

The email's FROM field looks as legit as can be:

Date: Wed, 01 Jun 2022 17:56:40 +0000 (UTC)
From: NORTON - quickbooks AT notification DOT intuit DOT com [edited for posting here]
Subject: Invoice Nort-8605 from NORTON

These lines are copy-pasted from the message source. Note my screenshot example below.

Hovering over the FROM in the unopened email shows that legit-looking email address. Opening the email shows the legit-looking FROM email. However, looking in the message source, in other areas, was the only way to prove that it was a spoof email. Does Intuit mention this at all? No. They say "if it looks legit, it's legit". That's exactly how scammers get your info; looking legit.

In the message source, I found undeniable proof that it wasn't from Norton or Intuit:

Reply-To: nornor three eight five AT hotmail DOT com [psuedo-ized for this post, but definitely not legit)

Other than me just knowing I never paid for a Norton product in years and years, this is the only way I could prove that it wasn't from Intuit without logging into my Intuit account and scouring around everywhere for any evidence of it.

Guess what, when Intuit gives recommendations that allow scammers to do their jobs, they're part of the scams; unwittingly or otherwise.

How do we get it through Intuit's thick skulls that their recommendations are inadequate and probably contributing to scams? They need to update their recommendations.

I also received an email with an invoice saying it was going to automatically charge my bank account.  I tried to call to talk to someone - complete WASTE of time!  Here is the email We have received your order.
We are much obliged to inform you that your order has been auto-renewed. We have charged you an amount of $349.99 for GeekSquad Totaltech Membership (2 Years) .
You can call our customer service team for a refund- +1 (806) 589 0730.

I don't have an account!!  It was received from this email [email address removed]

I understand that you want to protect your account from any phishing and malicious emails, topaztije.

Your safety is our priority, and we'll help you check the email. There are many reasons in today's environment to be cautious of email that seems in any way suspicious. Some email messages might be phishing scams, viruses, and other malicious software.

Intuit uses different email addresses to communicate with its customers. If you've received one that you believe is from us, you may use the information on this link to check if it's legitimate.

If the email you received looks suspicious, please forward it to the phishing/spoofing e-mail page so we can review it. You can also visit this link http://security.intuit.com. This is where Intuit's security team posts information about SPAM and Phishing email attempts.

However, if the email is coming from Intuit. I'd suggest going to your email and finding its title, which is “Urgent Payroll Issue.” Then, review the details listed in the email your getting. You can also contact our Customer Support Team. They can check the email you're getting and further investigate this.

Let me also share this article on how you can better protect your account and how we keep your data secure: 

• How To Recognize And Report Suspicious Emails
• How We Keep Your Data Safe

Please know that I'm only a few clicks away if you have any other questions or concerns. I'll be more than willing to assist. Have a good one!

Received an invoice from Norton for $ 452.97 for Quickbooks which did not order. Have forwarded the email to [email address removed] so that they are aware.