Fake QuickBooks and Intuit invoice emails: how to tell a scam from a real bill

QuickBooks sends millions of real invoices for small businesses, so an email that says "Invoice from QuickBooks" doesn't look strange to anyone in accounts payable. Scammers rely on that. This guide explains the forms the scam takes, including real QuickBooks invoices a scammer could send from their own account, how to check one safely, where to report it, and what to do if someone already paid.

What is a fake QuickBooks invoice email?

A fake QuickBooks invoice email is a phishing or billing scam that uses Intuit's QuickBooks name to make a request for money look routine. It may bill you for goods you never ordered, claim your own QuickBooks subscription payment failed, or carry a "View invoice" button that opens a fake Intuit sign-in page. The goal is a payment, a phone call to the scammer, or your login.

The FTC warns that scammers send businesses fake invoices for things they didn't order, such as tech support or domain registration, that some carry a "past due" notice to add pressure, and that fake invoices sent by email may be phishing aimed at your business data and networks (FTC, May 2026). QuickBooks is a convenient disguise because so many legitimate bills arrive that way.

None of this means Intuit was breached. The scam works by copying the brand, or by abusing an ordinary account, not by breaking into QuickBooks.

The four versions you'll see

The attachment version is covered in our guides to HTML attachment phishing and PDF phishing attachments.

Example of a fake QuickBooks invoice email

This is an example written for this guide. It is not a real Intuit or QuickBooks email.

From: QuickBooks Payments <billing@quickbooks-intuit-pay.com>
Subject: Invoice 10472 from Northline Supply Co. is past due

Dear Customer,

Your invoice is past due. Please review and pay to avoid
a late fee and collection.

Invoice: 10472
Amount due: $1,486.20
Due date: 10/28/2026

[ Review and pay ]

Questions about this charge? Call our billing team at
+1 (888) 555-0147.

Powered by QuickBooks

The tell-tale parts: a sender domain that isn't intuit.com, a generic "Dear Customer", a past-due threat, and a phone number for "questions". The checks below work even when the email looks perfect.

How do I know if a QuickBooks invoice is real?

You know a QuickBooks invoice is real when it comes from a business you actually buy from, matches a purchase someone in your company made, and that business confirms it through contact details you already have. A real Intuit sender address helps, but it isn't proof the money is owed.

What Intuit says about its emails

Intuit's help page says its official emails come from an address that ends with @intuit.com, for example @account.intuit.com, and warns about "slightly altered domain names" that look like intuit.com (Intuit QuickBooks Help). It also says Intuit will never ask in an email for "personal information, sign in or password details, banking or credit card information".

Intuit lists these warning signs: generic greetings such as "Dear Customer", urgent language such as "Immediate action required", requests for passwords or verification codes, unexpected attachments, and poor grammar or odd formatting.

Real vs fake QuickBooks invoices

Why a real Intuit address isn't enough

QuickBooks emails invoices on a business's behalf; Intuit's help center gives the default invoicing address as quickbooks@notification.intuit.com (Intuit QuickBooks Help). So the message comes from Intuit's systems even though the business wrote it. Intuit doesn't publish guidance on scam accounts, but whoever opens an account chooses the company name, amount and note, and the result would arrive from that genuine Intuit address and normally pass SPF, DKIM and DMARC, because Intuit really sent it. Scammers abuse PayPal invoices in exactly this way; see fake PayPal invoice emails.

So treat authentication as one check, not the verdict. If you want to see it, paste the headers into the Email Header Analyzer. A failed check or a lookalike domain proves the email is forged; a pass only proves who delivered it.

What should I do with a suspicious QuickBooks invoice?

If a QuickBooks invoice looks wrong, don't pay it, don't call any number in it and don't click its buttons. Check it outside the email, then report it.

1. Check your own records. Look for a purchase order, contract or approval that matches the vendor and amount. The FTC tells businesses to "check all invoices closely" and have clear procedures for approving vendor invoices (FTC).
2. Contact the vendor you know. Use a phone number or email from your vendor file, a past invoice or their official website, never the one in the suspicious email.
3. If it's about your own QuickBooks account, sign in by typing quickbooks.intuit.com yourself and check billing there. For help, contact Intuit Support using details from Intuit's own website, not a number from an email.
4. Report it to Intuit. Forward the email to security@intuit.com, as Intuit's help page asks, then delete it.
5. Report it to the FTC. Forward phishing to reportphishing@apwg.org and report the scam at ReportFraud.ftc.gov.
6. At work, use the Report button in Outlook or Gmail so IT can remove other copies. Our guide to reporting phishing emails covers each app.

If you already paid, called or signed in

• Paid by card, ACH or wire: call your bank or card issuer now and ask them to stop or reverse the payment. For a business payment, also file at ic3.gov; the FBI asks victims of business email compromise to contact their financial institution and file a complaint quickly.
• Called the number: if you gave card details, cancel the card. If you let the caller connect to your computer, disconnect it from the network and tell IT. Our guide to callback phishing explains how these calls go.
• Entered a password: change it from a trusted device, change it anywhere you reused it, and turn on two-step verification. For a work email account, tell IT; see what to do after clicking a phishing link.

How do businesses stop fake QuickBooks invoices?

Businesses stop fake QuickBooks invoices mostly with payment process, then with filtering. A scam invoice only costs money if someone pays it, so the controls that matter most sit in accounts payable.

Payment controls

1. No purchase order, no payment. Every invoice must match an order, contract or named approver.
2. Verify new vendors and changed bank details by phone using a number you already hold. Our guide to vendor invoice fraud and payment redirection covers the bank-change version, which is often far more costly.
3. Two people for large or unusual payments. One person approves, another releases.
4. One rule for staff: we never call phone numbers printed on unexpected invoices.

Email controls for admins

1. Block lookalike domains you see. In Microsoft 365, add them on the Domains & addresses tab at https://security.microsoft.com/tenantAllowBlockList (Add > Block; entries default to 30 days), or run New-TenantAllowBlockListItems -ListType Sender -Block -Entries "quickbooks-intuit-pay.com" -NoExpiration (Microsoft Learn). Don't block intuit.com; you'd block your real vendors' invoices too. See block a sender or domain in Microsoft 365.
2. Remove other copies. Use Threat Explorer or Real-time detections in Microsoft 365, or the security investigation tool in Google Workspace.
3. Tag external mail so a "QuickBooks" email that came from outside is visibly marked. See the Outlook external email warning tag.
4. Protect your own brand. If you send invoices yourself, scammers may fake you to your customers. Publish DMARC and watch for lookalike domains; see customers phished by a fake version of your company.

Forged versions from lookalike domains are the part an inbound filter can catch. An MX-level filter checks every message for phishing, spoofing and dangerous attachments before it reaches your mailboxes; our small business email security page explains how that fits a small team.

Next steps

1. Write down your invoice approval rule and share it with everyone who can pay a bill.
2. Save security@intuit.com and reportphishing@apwg.org where your finance team can find them.
3. Run the free DMARC Checker on your own domain so scammers can't easily send invoices as you.
4. If fake invoices keep arriving, see how iBlockSpam protects small businesses with filtering before mail reaches your inbox.

Browse our other phishing and threat guides.