Businesses warned over Quickbooks scam

Emails claiming to be from accounting software package Quickbooks asking to review customer feedback are being sent to businesses.

The email is designed to lure recipients into signing into the website linked in order to steal sensitive login information, including a one-time verification code that could help an attacker gain unauthorised access to an account.

We spot scams like this every week in The Scam Hound newsletter — one email, every Tuesday, free. → Subscribe

The report from Mailguard says it is a timely reminder for businesses using Quickbooks and other cloud-based financial platforms that convincing branding and sign-in workflows can be used to disguise plots to harvest credentials.

How the scam works

The email looks like a normal business notification and has a button saying that customer feedback has been received and you can click the link to review it - however, a teeltale sign that it is not genuine is that the email address is not fron Quickbooks or parent company Intuit, but from sgestudiocontable, according to Mailguard, which says that business itself may have been previously hacked.

What follows are a series of web pages which imitate the Quickbooks sign-in process, progessively asking for more sensitive data such as email or user ID and password before asking for a verification code which it will send to you email account.

If the verification code is input into the fake site, it could mean that criminals then have the ability to complete an unauthorised sign-in.

The reminder being given th businesses is that a familiar logo, polished interface and "routine" security checks do not necessarily mean that everything is genuine.

What precautions businesses can take

Mailguard offers these steps:

• Check the actual sender address. Do not rely on the display name or branding alone. In this example, the sender claims to be QuickBooks but uses a domain that is not an official QuickBooks or Intuit domain.

  
  

• Verify links before clicking. Pay attention to the destination domain and be cautious of unexpected tracking links. If a message claims that action is required in QuickBooks, access the service independently using a trusted bookmark or a known official address.

  
  

• Be wary of unexpected login prompts. A notification that asks you to sign in should not automatically be trusted simply because it resembles a familiar service.

  
  

• Protect verification codes. Never enter a one-time code into a page reached through a suspicious email. Do not disclose authentication codes to other people or approve sign-in requests you did not initiate.

  
  

• Use strong, unique passwords and multi-factor authentication. These controls help reduce the risk of unauthorised access, although authentication codes can still be exposed through phishing.

  
  

• Report suspicious emails promptly. Employees should know how to report potential phishing to their IT or security team without interacting further with the message.

  
  

• Act quickly if credentials have been exposed. Notify the security team immediately, change affected credentials through the legitimate service, revoke active sessions where possible and review account activity for suspicious sign-ins or changes.

We spot scams like this every week in The Scam Hound newsletter — one email, every Tuesday, free. → Subscribe