The email looks right. QuickBooks logo, clean layout, an invoice number, and a line saying your card was already charged $389 for an antivirus renewal you never ordered. There’s a phone number at the bottom to call if you want to dispute the charge.
That number is the whole scam.
These have been landing in inboxes all over Southwest Florida this summer, and they match the QuickBooks invoice scam Fort Myers businesses keep searching for answers about. Security reporters flagged a fresh wave of it this month. Here’s how the con works and how to keep your bookkeeper from wiring money to a call center.
How the fake invoice trick works
Scammers sign up for free QuickBooks trial accounts, then use them to send real invoices through Intuits own servers. The invoice claims to be from Amazon, Apple, PayPal, McAfee, Norton, whoever people tend to have a subscription with. Amounts usually sit between $300 and $600. High enough to sting, low enough to feel routine.
And because the email actually comes from QuickBooks, it sails through every authentication check your mail server runs. No misspelled domain, no link to a fake login page. Nothing for a spam filter to grab onto, which is why these keep showing up in clean inboxes that never see junk mail.
The pressure point is the phone number. You call to dispute a charge that never happened, and you land with a friendly “billing agent” whose real job is getting into your computer or your bank account.
Why offices that use QuickBooks fall hardest
The nasty part is the audience. Around here the tool is everywhere. Contractors in Cape Coral run their whole billing through it, and so do plenty of medical and law offices in town. When your team lives in QuickBooks all day, an invoice notification from Intuit reads as normal background noise, and the guard drops.
Scammers know that. That’s why they borrowed Intuits infrastructure instead of spoofing it. Security reporters who dug into this campaign found crews impersonating a rotating cast of brands from the same trial accounts, and the trick keeps resurfacing because it still works. These invoices even pass DKIM and SPF, the two checks admins usually trust to settle whether a message is real.
What happens when you call
Their script varies but the destination doesn’t. The agent offers a refund, and to process it they say they need a remote access tool installed, usually AnyDesk or TeamViewer. Once inside, they fake a “refund error” on your screen, claim they overpaid you, and press you to send the difference back with gift cards or a wire.
Some crews skip the theater and go straight for saved passwords and open banking tabs while you watch the cursor move.
The volume is real too. A bookkeeper could see three of these in one week, each claiming to be a different company, and that would be an ordinary week for the crews sending them.
Spotting the QuickBooks invoice scam Fort Myers offices are seeing
A few tells give it away once you know where to look.
- You get billed for something nobody ordered. Obvious, but panic makes people skip the obvious.
- The sender address is a real Intuit domain while the business name says Norton or McAfee. Companies that size bill from their own systems, not through someone else’s QuickBooks account.
- The only way to dispute the charge is a phone call. Real billing disputes happen inside the account you already have with that company.
- Urgency everywhere. Charged today, call within 24 hours.
What Fort Myers businesses can do: check your actual card or bank statement first, because in most cases no charge exists. Never call a number printed on an unexpected invoice. Look the company up on your own and use the number from their official site. Forward fake Intuit emails to [email protected] so they can shut the trial account down. And make it a standing rule that nobody installs remote access software during an inbound support call. Intuit keeps a page on spotting suspicious QuickBooks emails worth bookmarking, and if money already moved, report it to the FBI at IC3.gov the same day.
If someone already called the number
Don’t panic, but move fast.
Hang up and uninstall whatever remote tool they had installed. Run a full malware scan. Change the passwords for email and banking from a different device, since a keylogger may have watched you type the old ones. Then call your bank’s fraud line, the real one on the back of your card, and tell them what happened. Banks can sometimes claw back a wire inside the first day. After that the odds drop fast.
Keep an eye on the card statement for small test charges over the next month too. Crews sell working card numbers to other crews.
And tell the rest of the team the same day. These crews reuse target lists, so the same fake invoice tends to hit three or four inboxes at the same office within days.
Call us before you call the number on that invoice
HenkTek is an IT company in Fort Myers, and sorting real emails from fake ones is bread and butter work for us. It takes a couple minutes to check an invoice against your accounts. Unwinding a wire transfer takes a lot longer, when it works at all.
We handle managed IT and email security for small businesses across Fort Myers, Cape Coral, Bonita Springs, and Naples. If someone on your team already called one of these numbers, or your screen keeps filling up with fake McAfee popups again, get in touch or call (239) 234-2334. A free consultation beats an expensive lesson.