Real Intuit Invoice, Fake Geek Squad Bill, One Phone Number

A past-due invoice landed in a benefits broker's inbox with a subject built to make someone flinch: a Geek Squad PC Protection plan, two years, ten devices, $688.24, already overdue. The message came from quickbooks@notification.intuit[.]com. It was genuinely signed by Intuit. Every link inside it resolved to real Intuit domains, and every one of them scanned clean. There was no attachment and no malicious URL anywhere in the message.

The only thing in the email that could take money from anyone was a phone number: +1 (888) 581-6080. That number was the entire attack.

An Invoice That Was Real, for a Charge That Was Not

The attacker did not spoof Intuit. They used it. Intuit's QuickBooks platform lets anyone create and send invoices through its self-service invoicing feature, and those invoices go out as genuine Intuit notifications from Intuit's own sending infrastructure. So the attacker opened the front door legitimately, created an invoice, and typed a fabricated line item into it: "Geek Squad PC Protection, 2 Years Plan, 10 Device," framed as past due, with a due date earlier in the month and a review note stamped weeks later.

That single design choice defeated most of the controls this email would ever encounter. The notification really did originate from Intuit. The View Invoice and connection links pointed to connect.intuit[.]com and links.notification.intuit[.]com, both real, both hosting legitimate Intuit pages, both correctly rated safe by URL reputation engines. A defender inspecting the links would find nothing wrong, because nothing about the links was wrong. The fraud lived in a text field the attacker was allowed to fill in.

Geek Squad is a favorite brand for this play because the pretext is self-explanatory. Nobody remembers signing up for a device-protection plan, so a past-due notice for one manufactures instant confusion and a strong pull to "just call and sort it out." The scam is engineered to move the target off email, where filters and colleagues can see the message, and onto a phone line, where the attacker is alone with them.

Authentication Passed Where It Mattered

At the early hops, SPF, DKIM, and DMARC all passed for notification.intuit[.]com. That is expected, because Intuit genuinely signed and sent the message. A later hop showed a failure, but that break is explained by ordinary mail flow: the message traversed a Gmail-to-Mimecast-to-Microsoft 365 forwarding and gateway path, and a legitimate secure email gateway in that chain rewrote the message enough to break the original alignment. That is normal gateway behavior, not evidence of spoofing.

This is the trap. A control tuned to trust a clean authentication result would wave this through, and a control that treats a late-hop alignment break as proof of forgery would misread the signal entirely. The authentication story here is a distraction on both ends. It tells you the mail really came from Intuit. It tells you nothing about whether the invoice inside is honest.

The 2024 Verizon Data Breach Investigations Report puts pretexting, the social-engineering category that includes business email compromise and invoice fraud, at the top of the social-engineering breach types, with a median transaction of around fifty thousand dollars. Callback scams like this one are pretexting's voice-first cousin. They skip the malicious link precisely so that link-scanning and attachment sandboxing have nothing to grade.

Three Identities, One Message

The real signal was never in the authentication headers or the links. It was in the mismatch between who the message claimed to be, who it wanted you to reply to, and where its bounces were routed.

The From address was Intuit's genuine notification domain. The Reply-To, however, was no-reply@salesteams[.]com, an unrelated domain with a stale MarkMonitor registration and dead live DNS, answering nothing on A, MX, TXT, or NS lookups. The Return-Path bounce routing pointed at a throwaway nsiien91.onmicrosoft[.]com tenant. Three different identities in one invoice notification, none of which agreed with the others, is not how a real Intuit invoice behaves.

That inconsistency, paired with the classic callback-scam content pattern, an urgent past-due charge for a service the recipient never bought and a prominent phone number as the primary next step, is what Adaptive AI and community threat intelligence are built to catch. Signature-matching asks "is this domain authenticated and is this link malicious." Identity-and-behavior analysis asks "does this message act the way a genuine Intuit invoice acts, and does it point everyone toward a phone call." The first question passes the email. The second stops it.

Why the Phone Number Is the Whole Point

Once a target dials +1 (888) 581-6080, the defenses that live in the inbox are behind them. On the call, the attacker owns the script: a fake refund or cancellation flow, a request to install remote-access software to "process the reversal," a walk-through that quietly moves money the wrong direction or captures card and banking details outright. This is business email compromise territory, executed over the phone. The email exists only to place the call.

This was not a one-off. The same invoice-and-callback lure hit five mailboxes across the brokerage inside a single week, a spray designed to find the one person having a busy day who picks up the phone. The MITRE ATT&CK techniques here are T1566.004, phishing via voice, and T1598, phishing for information, and neither of them leaves a malicious file or URL for a scanner to seize on.

If your stack decides an email is safe once it authenticates and its links come back clean, this is the message that walks straight past it. Real infrastructure, real signing, real destinations, and a fraudulent charge steering everyone toward a phone number. The catch depends on reading identity and intent, not verdicts.

If you want a sense of how many messages like this your current gateway is quietly clearing, our email security gap calculator is a fast way to estimate what is slipping through.

Indicators of Compromise

See You Next Time

Clean auth and clean links are not the same as a clean email. When a message routes every path toward a phone call, read the identity, not the signature.