QuickBooks Phishing Scam is Back
Scammers are continuing to abuse the QuickBooks tax accounting software to send phishing scams, according to Roger Kay at INKY.
“All versions of QuickBooks have the ability to send invoices, and in this case, the bad guys turned this capability into an attack vector for a low-tech phone scam,” Kay writes. “In the past year, phone scams have been on the rise as phishers respond to the increasing sophistication of anti-phishing defenses: defenders go high, phishers go low. A simple mechanism is a phone number that the phishers want the mark to call. When they do, an operative will try to extract valuable information from them.”
The messages are impersonating Amazon, Apple, Best Buy, PayPal, Norton, and McAfee. Users are instructed to call a phone number to cancel a purchase they didn’t make.
“INKY began to see instances of this particular attack in December 2021,” Kay says. “They accelerated significantly in March 2022. Although we have detected 2,272 to date, that number is surely an undercount. The exact count is difficult to determine since the subtle scam emails and legitimate QuickBook notifications all originate from the real QuickBooks notification site: quickbooks@notification.intuit[.]com.”
Since QuickBooks is a legitimate software product, the phishing messages were able to bypass security filters.
“These attacks were highly effective at evading detection because they were identical to non-fraudulent QuickBooks notifications, even when examining the emails’ raw HTML files closely,” Kay says. “All notifications originated from authentic Intuit IP addresses, passed email authentication (SPF and DKIM) tests for intuit[.]com, and only contained high-reputation intuit[.]com URLs.”
Kay concludes that users should pause and think before reacting to messages that instill a sense of urgency.
“The effectiveness of these techniques relies on the panic a victim might feel if they received an invoice for goods or services that they did not purchase,” Kay writes. “The emotional reaction to notification of this sort can be strong and may impair judgment. The natural response is to get right on the phone and try to back the order out, or, barring that, find a way to obtain a refund. The phishers take advantage of this disrupted emotional state to extract personal or financial information before the victim realizes that something is off.”
New-school security awareness training can enable your employees to thwart phishing attacks by teaching them how to recognize social engineering tactics.
INKY has the story.
Free Phishing Security Test
Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.
Here’s how it works:
- Immediately start your test for up to 100 users (no need to talk to anyone)
- Select from 20+ languages and customize the phishing test template based on your environment
- Choose the landing page your users see after they click
- Show users which red flags they missed, or a 404 page
- Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
- See how your organization compares to others in your industry
PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser: https://info.knowbe4.com/phishing-security-test-partner?partnerid=001a000001lWEoJAAW