"We were unable to process your QuickBooks subscription renewal. To avoid an interruption in service, call our billing team at the toll-free number below."
Here's a hypothetical, and everyone in it is made up. Tess runs Juniper Row Flowers (a made-up florist) with three part-timers and a walk-in cooler full of stems for a Saturday wedding. Her books, her payroll and her business checking all live in QuickBooks. Every weekday her MCA funder pulls $286 from that account.
The email lands at 4:40 PM on a Thursday. Intuit logo. QuickBooks green. Her name in the greeting. No link to click, just a phone number. Tess thinks about payroll failing on Friday and dials.
The man who answers is calm and fast. He has her business name. He says the card on file was declined and he can fix it in two minutes. First he needs to "verify the account owner," so he's sending a code to her phone. Could she read it back?
She reads him six digits. Then he asks her to install a "secure billing tool" so he can see her screen.
Here's the turn. Nothing was wrong with her subscription. The code he asked for was the key to her account. Intuit says support callbacks are only scheduled when you ask for help inside QuickBooks, and that it doesn't cold-call to fix technical problems or ask for sensitive details (QuickBooks Community).
This one is moving right now. On Oct. 29, 2026, security researchers at Infoblox said they found a phishing campaign impersonating QuickBooks support that used more than 350 lookalike domains, most registered in a single week in late June and early July 2026. The emails push people to call a "toll-free" number, and the numbers they observed used an 805 area code. The callers try to steal QuickBooks logins (Infoblox). Intuit posted its own scam checklist on Oct. 22 (QuickBooks Community).
It doesn't always start with a fake email. In March, Bitdefender wrote up a small business owner's online account of a "callback" that came after they had really asked QuickBooks support for help with a check error. The caller already knew the problem and asked them to read back a verification code. Money started leaving the company account that night. The owners first counted about $95,000 gone, and the banking partner credited back $95,469.97. Then they found the total taken was $154,690.97 (Bitdefender).
Red flags
- A billing or "account problem" email with a phone number and no link. Intuit says many of these messages contain only a number to call (QuickBooks Community).
- A sender address on a domain that isn't Intuit's own. Intuit says its real emails come from its company domain (QuickBooks Community).
- Anyone on the phone asking you to read back a verification code. The FTC says anyone who asks for your code is a scammer (FTC).
- A request to install software or give remote access "to fix billing" (QuickBooks Community).
- Caller ID that shows Intuit. It can be spoofed to match a real support line (QuickBooks Community).
- A caller who knows your real support issue. In the Bitdefender case, that's exactly what made it feel safe (Bitdefender).
What to do
Don't call the number in the email. Sign in to QuickBooks yourself, from your own bookmark or the app, and check whether a billing problem really exists. If you need support, use Help or Contact Support inside the product.
Never read a code to anyone, even a caller who knows your ticket. Hang up and reach support through your account.
Tell your bookkeeper and anyone else with access to your books today. One person reading one code can open the whole account.
If you already shared a code or gave remote access, disconnect the computer from the internet, remove whatever they had you install, change your password from a trusted device and turn on multi-factor authentication. Call your bank or card issuer right away and ask about stopping or reversing transfers (QuickBooks Community). Report it to Intuit through its security center, to the FTC at its fraud report site and to the FBI's Internet Crime Complaint Center.
Tess never installed the tool. Something about "secure billing tool" made her hang up and open QuickBooks on her laptop. No failed payment. No banner. Just a new login alert from a city she'd never been to, timestamped 4:47 PM. She changed her password with the phone still warm in her hand.
