{"id":19177,"date":"2022-05-30T06:10:27","date_gmt":"2022-05-30T14:10:27","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2022\/05\/30\/news-12910\/"},"modified":"2022-05-30T06:10:27","modified_gmt":"2022-05-30T14:10:27","slug":"news-12910","status":"publish","type":"post","link":"https:\/\/www.palada.net\/index.php\/2022\/05\/30\/news-12910\/","title":{"rendered":"Intuit phish says \u201cwe have put a temporary hold on your account\u201d"},"content":{"rendered":"<p><strong>Credit to Author: Pieter Arntz| Date: Mon, 30 May 2022 13:59:22 +0000<\/strong><\/p>\n<p>Intuit released a <a href=\"https:\/\/security.intuit.com\/security-notices\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">warning about a phishing email<\/a> being sent to its customers. The phishing emails tell recipients that their account has been put on hold, and try to trick users into \u201cvalidating their account\u201d to release it again.<\/p>\n<h2>Intuit<\/h2>\n<p>Intuit Inc. is an American business software company that specializes in financial software. Intuit&#8217;s products include the tax preparation application TurboTax, personal finance app Mint, the small business accounting program QuickBooks, the credit monitoring service Credit Karma, and email marketing platform Mailchimp.<\/p>\n<p>The example email for this campaign claims to come from the QuickBooks Team.<\/p>\n<h2>The email<\/h2>\n<p>Intuit has recently received reports from customers that they have received emails similar to the one below. The email explains to the receiver that their account is temporarily on hold, and what they need to do to remediate that situation.<\/p>\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" data-attachment-id=\"56962\" data-permalink=\"https:\/\/blog.malwarebytes.com\/social-engineering\/2022\/05\/intuit-phish-says-we-have-put-a-temporary-hold-on-your-account\/attachment\/sir0077283_spoof\/\" data-orig-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/05\/sir0077283_spoof.png\" data-orig-size=\"1112,570\" data-comments-opened=\"0\" data-image-meta=\"{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;}\" data-image-title=\"sir0077283_spoof\" data-image-description=\"\" data-image-caption=\"\" data-medium-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/05\/sir0077283_spoof-300x154.png\" data-large-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/05\/sir0077283_spoof-600x308.png\" width=\"600\" height=\"308\" src=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/05\/sir0077283_spoof-600x308.png\" alt=\"email example\" class=\"wp-image-56962\" srcset=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/05\/sir0077283_spoof-600x308.png 600w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/05\/sir0077283_spoof-300x154.png 300w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/05\/sir0077283_spoof.png 1112w\" sizes=\"auto, (max-width: 600px) 100vw, 600px\" \/><figcaption>Image of phishing email courtesy of Intuit<\/figcaption><\/figure>\n<\/div>\n<p id=\"block-e594ff9c-b258-4be8-9a62-d987355fc4e6\">The email reads:<\/p>\n<pre class=\"wp-block-preformatted\">Dear Customer,  We\u2019re writing to let you know that, after conducting a review of your business, we have been unable to verify some information on your account. For that reason, we have put a temporary hold on your account.  What you can do  If you believe that we\u2019ve made a mistake, we\u2019d like to remedy the situation as quickly as possible. To help us effectively revisit your account, please complete the below verification form:\u201d  [large green button that is definitely not going to Intuit]  Once verification has been completed, we will re-view your account within 24-48 hours.  We\u2019re sorry that we can no longer offer our services to you, and we wish you the best of luck with your business.  QuickBooks Support<\/pre>\n<p>The \u201cComplete Verification\u201d button in the phishing email will likely redirect recipients to a phishing site designed to harvest personal information, or infect victims with malware.<\/p>\n<p>Needless to say, <em>this email did not come from Intuit<\/em>.<\/p>\n<p>Intuit wants you to know that &#8220;the sender is not associated with Intuit, is not an authorized agent of Intuit, nor is their use of Intuit&#8217;s brands authorized by Intuit.&#8221;<\/p>\n<h2>Clues<\/h2>\n<p>Some details of the email are clues that you are not dealing with Intuit.<\/p>\n<ul>\n<li>The actual email address of the sender (vcn @ fucaxcapital[.]com) does not belong to Intuit.<\/li>\n<li>Hovering over the button would show you that it doesn&#8217;t got to an intuit.com URL.<\/li>\n<\/ul>\n<p>Some details offer softer clues that you should be suspicious: <\/p>\n<ul>\n<li>Phishing emails want urgent action\u2014this one wants you to act &#8220;as quickly as possible&#8221;.<\/li>\n<li>It&#8217;s unlikely that Intuit would address you &#8220;Dear Customer&#8221; in a case like this.<\/li>\n<li>Intuit normally asks you to sign in to its website rather than sending emails with clickable buttons.<\/li>\n<\/ul>\n<h2>What you really should do<\/h2>\n<p>In the <a href=\"https:\/\/security.intuit.com\/security-notices\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">security notice<\/a>, Intuit\u00a0advises customers who received one of these phishing messages not to click any embedded links or open any attachments. We suggest that you delete the suspicious email from your inbox, if you have it, to avoid falling into the trap at a later point.<\/p>\n<p>QuickBooks users who have already opened attachments or clicked links after receiving one of these phishing emails should:<\/p>\n<ol type=\"1\">\n<li>Change their passwords.<\/li>\n<li>Delete any downloaded files\u00a0immediately.<\/li>\n<li>Scan their systems using an <a href=\"https:\/\/www.malwarebytes.com\/business\/endpoint-protection\">up-to-date anti-malware solution<\/a>.<\/li>\n<\/ol>\n<p>Businesses can find some more tips to deal with phishing attempts in our article <a href=\"https:\/\/blog.malwarebytes.com\/101\/2019\/02\/business-anti-phishing\/\">Businesses: It\u2019s time to implement an anti-phishing plan<\/a>.<\/p>\n<p>Stay safe, everyone!<\/p>\n<p>The post <a rel=\"nofollow\" href=\"https:\/\/blog.malwarebytes.com\/social-engineering\/2022\/05\/intuit-phish-says-we-have-put-a-temporary-hold-on-your-account\/\">Intuit phish says \u201cwe have put a temporary hold on your account\u201d<\/a> appeared first on <a rel=\"nofollow\" href=\"https:\/\/blog.malwarebytes.com\">Malwarebytes Labs<\/a>.<\/p>\n<p><a href=\"https:\/\/blog.malwarebytes.com\/social-engineering\/2022\/05\/intuit-phish-says-we-have-put-a-temporary-hold-on-your-account\/\" target=\"bwo\" >https:\/\/blog.malwarebytes.com\/feed\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p><strong>Credit to Author: Pieter Arntz| Date: Mon, 30 May 2022 13:59:22 +0000<\/strong><\/p>\n<p>Intuit warns of a phishing email telling customers to validate their account to clear a temporary hold.<\/p>\n<p>The post <a rel=\"nofollow\" href=\"https:\/\/blog.malwarebytes.com\/social-engineering\/2022\/05\/intuit-phish-says-we-have-put-a-temporary-hold-on-your-account\/\">Intuit phish says \u201cwe have put a temporary hold on your account\u201d<\/a> appeared first on <a rel=\"nofollow\" href=\"https:\/\/blog.malwarebytes.com\">Malwarebytes Labs<\/a>.<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[10488,10378],"tags":[15496,23338,3924,18077,26326,10510,26327],"class_list":["post-19177","post","type-post","status-publish","format-standard","hentry","category-malwarebytes","category-security","tag-awareness","tag-intuit","tag-phishing","tag-quickbooks","tag-security-notice","tag-social-engineering","tag-temporary-hold"],"_links":{"self":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/19177","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/comments?post=19177"}],"version-history":[{"count":0,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/19177\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/media?parent=19177"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/categories?post=19177"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/tags?post=19177"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}