# Fake QuickBooks and Intuit invoice emails: how to tell a scam from a real bill

URL: https://iblockspam.com/blog/fake-quickbooks-intuit-invoice-emails
Last updated: 2026-11-02
Published: 2026-11-02
Topic: Phishing & threats
Author: iBlockSpam Team

> How fake QuickBooks and Intuit invoice emails work, why a real Intuit sender address isn't proof, how to check one, where to report it, and what to do if you paid.

## Short answer

A fake QuickBooks invoice email bills you for something you never ordered, or claims your QuickBooks payment failed, to get money, a call or your login. Intuit says its emails come from addresses ending in @intuit.com and never ask for passwords. Don't pay, call or click. Check with the vendor you know and forward it to security@intuit.com.

QuickBooks sends millions of real invoices for small businesses, so an email that says "Invoice from QuickBooks" doesn't look strange to anyone in accounts payable. Scammers rely on that. This guide explains the forms the scam takes, including real QuickBooks invoices a scammer could send from their own account, how to check one safely, where to report it, and what to do if someone already paid.

## What is a fake QuickBooks invoice email?

A fake QuickBooks invoice email is a phishing or billing scam that uses Intuit's QuickBooks name to make a request for money look routine. It may bill you for goods you never ordered, claim your own QuickBooks subscription payment failed, or carry a "View invoice" button that opens a fake Intuit sign-in page. The goal is a payment, a phone call to the scammer, or your login.

The FTC warns that scammers send businesses fake invoices for things they didn't order, such as tech support or domain registration, that some carry a "past due" notice to add pressure, and that fake invoices sent by email may be phishing aimed at your business data and networks ([FTC, May 2026](https://consumer.ftc.gov/consumer-alerts/2026/05/run-small-business-pay-your-bills-not-scammers)). QuickBooks is a convenient disguise because so many legitimate bills arrive that way.

None of this means Intuit was breached. The scam works by copying the brand, or by abusing an ordinary account, not by breaking into QuickBooks.

### The four versions you'll see

| Version | What arrives | What it wants |
|---|---|---|
| Forged QuickBooks email | A copy of a QuickBooks invoice from a lookalike domain, with a "View invoice" or "Pay now" button | Your email or Intuit password on a fake sign-in page, or card details |
| Real invoice from a scam account | A genuine QuickBooks invoice from a "company" you've never used, often with a note to call about the charge | A payment, or a call to a fake support line |
| Fake Intuit account notice | "Your QuickBooks subscription payment failed" or "Your account will be suspended" | Your Intuit login and card details |
| Attachment lure | "Invoice_88213.pdf" that's really an HTML file or a link to download one | Your password, or malware |

The attachment version is covered in our guides to [HTML attachment phishing](https://iblockspam.com/blog/html-attachment-phishing-html-smuggling) and [PDF phishing attachments](https://iblockspam.com/blog/pdf-phishing-attachments).

### Example of a fake QuickBooks invoice email

This is an **example** written for this guide. It is not a real Intuit or QuickBooks email.

```
From: QuickBooks Payments <billing@quickbooks-intuit-pay.com>
Subject: Invoice 10472 from Northline Supply Co. is past due

Dear Customer,

Your invoice is past due. Please review and pay to avoid
a late fee and collection.

Invoice: 10472
Amount due: $1,486.20
Due date: 10/28/2026

[ Review and pay ]

Questions about this charge? Call our billing team at
+1 (888) 555-0147.

Powered by QuickBooks
```

The tell-tale parts: a sender domain that isn't `intuit.com`, a generic "Dear Customer", a past-due threat, and a phone number for "questions". The checks below work even when the email looks perfect.

## How do I know if a QuickBooks invoice is real?

You know a QuickBooks invoice is real when it comes from a business you actually buy from, matches a purchase someone in your company made, and that business confirms it through contact details you already have. A real Intuit sender address helps, but it isn't proof the money is owed.

### What Intuit says about its emails

Intuit's help page says its official emails come from an address that ends with `@intuit.com`, for example `@account.intuit.com`, and warns about "slightly altered domain names" that look like intuit.com ([Intuit QuickBooks Help](https://quickbooks.intuit.com/learn-support/en-us/help-article/fraud/identify-suspicious-activity-phishing-scams-fraud/L2NzZQnZu_US_en_US)). It also says Intuit will never ask in an email for "personal information, sign in or password details, banking or credit card information".

Intuit lists these warning signs: generic greetings such as "Dear Customer", urgent language such as "Immediate action required", requests for passwords or verification codes, unexpected attachments, and poor grammar or odd formatting.

### Real vs fake QuickBooks invoices

| Check | Real QuickBooks invoice | Fake or scam invoice |
|---|---|---|
| Sender domain | Ends in `intuit.com` | Lookalike such as `quickbooks-intuit-pay.com`, or a free mailbox |
| Business named | A vendor you use, with a purchase order or contract behind it | A company nobody in your office recognizes |
| Amount and items | Match an order or agreement | Round "service fees", software renewals or goods you never received |
| Asks you to call | Rarely, and only the vendor's known number | Often, the main point of the email |
| Asks for a password to view | No; Intuit says it never asks for sign-in details by email | Often, a "sign in to view" page |
| Pressure | Normal payment terms | "Past due", late fees, collections, account suspension |

### Why a real Intuit address isn't enough

QuickBooks emails invoices on a business's behalf; Intuit's help center gives the default invoicing address as `quickbooks@notification.intuit.com` ([Intuit QuickBooks Help](https://quickbooks.intuit.com/learn-support/en-au/help-article/manage-customers/3-solutions-customers-receiving-emails/L9ypZGV4I_AU_en_AU)). So the message comes from Intuit's systems even though the business wrote it. Intuit doesn't publish guidance on scam accounts, but whoever opens an account chooses the company name, amount and note, and the result would arrive from that genuine Intuit address and normally pass SPF, DKIM and DMARC, because Intuit really sent it. Scammers abuse PayPal invoices in exactly this way; see [fake PayPal invoice emails](https://iblockspam.com/blog/fake-paypal-invoice-scam-emails).

So treat authentication as one check, not the verdict. If you want to see it, paste the headers into the [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer). A failed check or a lookalike domain proves the email is forged; a pass only proves who delivered it.

## What should I do with a suspicious QuickBooks invoice?

If a QuickBooks invoice looks wrong, don't pay it, don't call any number in it and don't click its buttons. Check it outside the email, then report it.

1. **Check your own records.** Look for a purchase order, contract or approval that matches the vendor and amount. The FTC tells businesses to "check all invoices closely" and have clear procedures for approving vendor invoices ([FTC](https://consumer.ftc.gov/consumer-alerts/2026/05/run-small-business-pay-your-bills-not-scammers)).
2. **Contact the vendor you know.** Use a phone number or email from your vendor file, a past invoice or their official website, never the one in the suspicious email.
3. **If it's about your own QuickBooks account,** sign in by typing `quickbooks.intuit.com` yourself and check billing there. For help, contact Intuit Support using details from Intuit's own website, not a number from an email.
4. **Report it to Intuit.** Forward the email to `security@intuit.com`, as Intuit's help page asks, then delete it.
5. **Report it to the FTC.** Forward phishing to `reportphishing@apwg.org` and report the scam at [ReportFraud.ftc.gov](https://reportfraud.ftc.gov/).
6. **At work, use the Report button** in Outlook or Gmail so IT can remove other copies. Our guide to [reporting phishing emails](https://iblockspam.com/blog/report-phishing-email) covers each app.

### If you already paid, called or signed in

- **Paid by card, ACH or wire:** call your bank or card issuer now and ask them to stop or reverse the payment. For a business payment, also file at [ic3.gov](https://www.ic3.gov/CrimeInfo/BEC); the FBI asks victims of business email compromise to contact their financial institution and file a complaint quickly.
- **Called the number:** if you gave card details, cancel the card. If you let the caller connect to your computer, disconnect it from the network and tell IT. Our guide to [callback phishing](https://iblockspam.com/blog/callback-phishing-phone-scam-emails) explains how these calls go.
- **Entered a password:** change it from a trusted device, change it anywhere you reused it, and turn on two-step verification. For a work email account, tell IT; see [what to do after clicking a phishing link](https://iblockspam.com/blog/what-to-do-after-clicking-phishing-link).

## How do businesses stop fake QuickBooks invoices?

Businesses stop fake QuickBooks invoices mostly with payment process, then with filtering. A scam invoice only costs money if someone pays it, so the controls that matter most sit in accounts payable.

### Payment controls

1. **No purchase order, no payment.** Every invoice must match an order, contract or named approver.
2. **Verify new vendors and changed bank details by phone** using a number you already hold. Our guide to [vendor invoice fraud and payment redirection](https://iblockspam.com/blog/vendor-invoice-fraud-payment-redirection) covers the bank-change version, which is often far more costly.
3. **Two people for large or unusual payments.** One person approves, another releases.
4. **One rule for staff:** we never call phone numbers printed on unexpected invoices.

### Email controls for admins

1. **Block lookalike domains you see.** In Microsoft 365, add them on the **Domains & addresses** tab at `https://security.microsoft.com/tenantAllowBlockList` (**Add** > **Block**; entries default to 30 days), or run `New-TenantAllowBlockListItems -ListType Sender -Block -Entries "quickbooks-intuit-pay.com" -NoExpiration` ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/tenant-allow-block-list-email-spoof-configure)). Don't block `intuit.com`; you'd block your real vendors' invoices too. See [block a sender or domain in Microsoft 365](https://iblockspam.com/blog/block-sender-or-domain-microsoft-365).
2. **Remove other copies.** Use [Threat Explorer or Real-time detections](https://iblockspam.com/blog/microsoft-365-threat-explorer-real-time-detections) in Microsoft 365, or the [security investigation tool](https://iblockspam.com/blog/google-workspace-security-investigation-tool) in Google Workspace.
3. **Tag external mail** so a "QuickBooks" email that came from outside is visibly marked. See the [Outlook external email warning tag](https://iblockspam.com/blog/outlook-external-email-warning-tag).
4. **Protect your own brand.** If you send invoices yourself, scammers may fake you to your customers. Publish DMARC and watch for lookalike domains; see [customers phished by a fake version of your company](https://iblockspam.com/blog/customers-phished-by-fake-version-of-your-company).

Forged versions from lookalike domains are the part an inbound filter can catch. An MX-level filter checks every message for phishing, spoofing and dangerous attachments before it reaches your mailboxes; our [small business email security](https://iblockspam.com/solutions/small-business) page explains how that fits a small team.

## Next steps

1. Write down your invoice approval rule and share it with everyone who can pay a bill.
2. Save `security@intuit.com` and `reportphishing@apwg.org` where your finance team can find them.
3. Run the free [DMARC Checker](https://iblockspam.com/tools/dmarc-checker) on your own domain so scammers can't easily send invoices as you.
4. If fake invoices keep arriving, see how [iBlockSpam protects small businesses](https://iblockspam.com/solutions/small-business) with filtering before mail reaches your inbox.

Browse our other [phishing and threat guides](https://iblockspam.com/blog/topic/threats).

## Frequently asked questions

### How do I know if a QuickBooks invoice email is real?

Ask whether you actually do business with the company named on it, then check with that company using a phone number or email you already have, not the details in the invoice. Intuit says its own emails come from addresses ending in @intuit.com. A genuine sender doesn't prove the bill is owed, because anyone with a QuickBooks account can send an invoice.

### Can scammers send invoices through real QuickBooks accounts?

It's possible. QuickBooks emails invoices from an Intuit address on behalf of whoever created them, so a scammer with an account could send a bill that arrives from a genuine Intuit address and passes authentication checks. PayPal invoices are abused this way. Judge the content: a bill you don't owe, or a note telling you to call a number.

### Where do I forward a fake QuickBooks or Intuit email?

Intuit asks you to forward phishing that uses its brand to security@intuit.com, without clicking links or opening attachments. The FTC also takes phishing at reportphishing@apwg.org and fraud reports at ReportFraud.ftc.gov. At work, report it with your mail app's phishing button too, so your IT team can remove other copies.

### Should I call the phone number on a QuickBooks invoice I don't recognize?

No. A phone number on an unexpected invoice usually goes straight to the scammer, who then asks for card details, a refund payment or remote access to your computer. If you use QuickBooks, contact Intuit Support using details from Intuit's own website. If the invoice names a vendor you know, call the number you already have on file.

### I paid a fake QuickBooks invoice. Can I get the money back?

Contact your bank or card issuer straight away and ask them to stop or reverse the payment; the faster you call, the better your chances. Then report it at ReportFraud.ftc.gov, and for a business wire or ACH payment, file a complaint at ic3.gov. Keep the email, invoice and payment records for your bank and the report.

## Sources

- [Intuit QuickBooks Help: Identify suspicious activity and phishing scams](https://quickbooks.intuit.com/learn-support/en-us/help-article/fraud/identify-suspicious-activity-phishing-scams-fraud/L2NzZQnZu_US_en_US)
- [FTC Consumer Alert: Run a small business? Pay your bills, not scammers (May 2026)](https://consumer.ftc.gov/consumer-alerts/2026/05/run-small-business-pay-your-bills-not-scammers)
- [FTC: Phishers send fake invoices (February 2018)](https://consumer.ftc.gov/consumer-alerts/2018/02/phishers-send-fake-invoices)
- [Intuit QuickBooks Help: Troubleshoot if customers aren't receiving emails (default invoicing address)](https://quickbooks.intuit.com/learn-support/en-au/help-article/manage-customers/3-solutions-customers-receiving-emails/L9ypZGV4I_AU_en_AU)
- [FTC: ReportFraud.ftc.gov](https://reportfraud.ftc.gov/)
- [FBI IC3: Business Email Compromise](https://www.ic3.gov/CrimeInfo/BEC)
- [Microsoft Learn: Allow or block email using the Tenant Allow/Block List](https://learn.microsoft.com/en-us/defender-office-365/tenant-allow-block-list-email-spoof-configure)

## Free tools for this guide

- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject.
- [Lookalike Domain Generator](https://iblockspam.com/tools/lookalike-domain-generator): See typo, look-alike character and other-ending versions of your domain, and which of them exist in DNS or have a mail server.

---

Source: iBlockSpam, https://iblockspam.com/blog/fake-quickbooks-intuit-invoice-emails (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt