A friend received a spam email from quickbooks@notification.intuit.com

Intuit is a real company, and intuit.com is their real domain. Looking online, a number of people received this scam email a few months ago, and then again over the last week.

If you came across this post from Google, this is why it reeks of a scam email:

  • 12 of other email addresses are listed in the to and cc fields
  • it says that a subscription is set to renew, “$399.99 will soon be taken out of your account” and that it will happen within the “next 24 hours”. Classic sense of urgency
  • It includes an 888 phone number that does not come up as any legitimate number, and it includes a PDF which my friend did not download in case it is malicious

Does this mean that Intuit lost control of that subdomain, or is there another way that someone might be spoofing it? I can have my friend check any other metadata if it would be helpful.

If you came here from Google, welcome to the Fediverse :)

  • hddsx
    111·
    19 days ago

    Even if you do have DKIM, DMARC, and SPF someone can still spoof your domain and the admin will still get an email about it. After that, instructions are unclear since the receiving domain is rejecting it properly.

    Ask me how I know

    • hendrik@palaver.p3x.de
      2·
      19 days ago

      Yeah, it has to be both sides cooperating. You can set a recommendation what to do with mails that failed the checks. Including dropping the mail altogether. But it’s open to the receiver to honor that request, or not do any checks at all.