Researchers at INKY Technology Corp. today detailed a new phone scam variant that uses QuickBooks to trick victims into handing over personal information.
The scam involves scammers setting up free 30-day trial QuickBook accounts to send invoices to potential victims. The scammers send invoices claiming that the victims had purchased an item and their credit cards have already been charged. The text in the invoice states that if the targeted victims wish to dispute the charges, they should contact the phone number in the email.
The first-stage trick here is that the scammers are using legitimate QuickBook accounts and the invoices are made in and sent from Quickbooks, meaning that they appear legitimate. The invoices were found to impersonate brands, including Amazon.com Inc., Apple Inc., Best Buy Co. Inc., PayPal Holdings Inc. and other providers in an effort to make the invoices appear even more legitimate.
Although the emails are sent from Quickbooks, there are some giveaways that all is not as it should be. In various examples, Quickbook emails referred to Amazon as “Amazn” or “Amzn” to evade detection filters. If victims clicked on a link, they were taken to intuit.com (the parent company of Quickbooks) where the bad actors had created the fraudulent invoice, further adding to the invoice’s apparent legitimacy.
If the targeted victim calls the number in the email to dispute the alleged charge, the scammer attempts to extract information from the…
