phishing from Intuit customer service

[Strongsilence-CPA]

I have a suspicious email from Intuit customer service. I called support and she said it was phishing.

the email came from:

no reply   at   qemailserver.com

Everything appears normal except the date of the service.  The email lists today. I didn't call support today.  I haven't called for 4 days.

When I hover on the link to Take the Survey, I see intuitcare.co1.qualtrics.com.  

UPDATE - After some deliberation, I think this was an honest mistake by Timberly.  The email and link address look normal.  I think Timberly sent it to the wrong customer.  

@IntuitAlicia 

[IntuitGabi]

Thank you, I sent an email to phishing@intuit.com with a link to this post. 

[JACOB MARLEY]

I too have recently started receiving multiple phishing emails purportedly from Lacerte. I forwarded the scam email shown below to - phishing@intuit.com - but don't know if "humans" actually read emails forwarded to that address.

Below is the email:

--------------------------------

-------- Original Message --------
Subject: Get to know your options with Intuit
Date: Fri, 16 Jun 2023 20:16:03 +0000 (GMT)
From: [removed] 

Hi Steven,
My name is Michelle and I?m a consultant with Intuit Accountants. I wanted to congratulate you on your recently renewed Intuit tax software for the upcoming 2023 season! As always, we are here to answer any of your questions or concerns if you may need us.Also, I would like to mention our Hosting and eSignature products that are here to help meet you and your client's needs. With our new cloud-based environment Hosting, preparers can work from multiple locations, have added security, and reduced IT hassles. With eSignature, you can offer your clients a safe and efficient way to sign their documents right from their phone or computer.If you would like to learn about special pricing and more information regarding either of these products, please let me know and we can schedule a call.
Thank you for being the best part of Intuit,
Michelle
Intuit Consultant - ProSeries & Lacerte

This message was sent to you as an Intuit customer, consistent with your email preferences. Please note that if you have chosen not to receive marketing messages, you will still continue to receive business communications about your selected Intuit product(s), which may either affect your service or software, your account, or which may be legally required.

To unsubscribe from marketing emails or change your email preferences, https://data-privacy.app.intuit.com/preferences" title="https://data-privacy.app.intuit.com/preferences Click or tap to follow the link" target="_blank" rel="noopener noreferrer">Click Here. Changes may take up to 10 days to process.
Intuit respects your privacy. To learn more, read our Privacy Statement.
If you receive a suspicious email, please report it by forwarding the email to spoof@intuit.com.
Visit Security to find out more about Intuit?s security practices.
© 2018 Intuit Inc., All rights reserved. Trademarks.

=======================================================

URLS SHOWN IN FINAL PARAGRAPH:

To unsubscribe from marketing emails or change your email preferences, Click Here.
https://data-privacy.app.intuit.com/preferences
Changes may take up to 10 days to process.
Intuit respects your privacy. To learn more, read our Privacy Statement.
https://security.intuit.com/index.php/privacy
If you receive a suspicious email, please report it by forwarding the email to spoof@intuit.com.
Visit Security
https://security.intuit.com/index.php
to find out more about Intuit?s security practices.
© 2018 Intuit Inc., All rights reserved.
Trademarks.
http://www.intuit.com/legal/trademark/

FULL HEADERS OF SUSPICIOUS EMAIL:

Authentication-Results:MTA-0.0.0.0; dkim=pass header.d=intuit.com header.s=mintsupport header.b=mpP2gfh4; spf=pass (MTA-0.0.0.0: domain of "michelle_watson=intuit.com__imqucix8caxsqbsl@k6g2xi342kvgy1v7.kg26uph9bq7uuzkj.6v05.i-xs0jeac.na113.bnc.salesforce.com" designates 13.110.14.222 as permitted sender) smtp.mailfrom="michelle_watson=intuit.com__imqucix8caxsqbsl@k6g2xi342kvgy1v7.kg26uph9bq7uuzkj.6v05.i-xs0jeac.na113.bnc.salesforce.com"; dmarc=pass (policy=reject) header.from=intuit.com
Cc:"michelle_watson@intuit.com" <michelle_watson@intuit.com>
Content-Type:multipart/mixed; boundary="----=_Part_1898_739442942.1686946563858"
Date:Fri, 16 Jun 2023 20:16:03 +0000 (GMT)
Dkim-Signature:v=1; a=rsa-sha256; c=relaxed/simple; d=intuit.com; s=mintsupport; t=1686946564; bh=uaoWn2vAyeld+GYSO7mQCbFCE5208e3sIbZWpxJlBbU=; h=Date:From:To:Subject:MIME-Version:Content-Type; b=mpP2gfh4sW5uqG65jUebmjcCdnCnsz2DT1I9G9Z636Ho2hoFbOfQM4Y9siPhorZ8j 53qDFmqNjblq9kG2RHb7hgq+XtMso8dQb6YaEnoA/eOHDUf2TELJc3oluwAsXrDIWL fC6C/6kMgx3LvGtA1iJZRgUqdxfciKZNTpofh1rY=
Dmarc-Filter:OpenDMARC Filter v1.3.2 mail157c40.carrierzone.com 35GKG4Kv010405
From:Michelle Watson <michelle_watson@intuit.com>
Message-ID:<d-sP-000000000000000000000000000000000000000000000RWD4AQ00eDVvGYQuTAKyjhh5ihX8vQ@sfdc.net>
Mime-Version:1.0
Received:from [10.176.20.67] ([10.176.20.67:54932] helo=na113-app2-16-ia2.ops.sfdc.net) by mx1-ia2-sp4.mta.salesforce.com (envelope-from <michelle_watson=intuit.com__imqucix8caxsqbsl@k6g2xi342kvgy1v7.kg26uph9bq7uuzkj.6v05.i-xs0jeac.na113.bnc.salesforce.com>) (ecelerity 4.4.0.19839 r(msys-ecelerity:tags/4.4.0.0^0)) with ESMTPS (cipher=ECDHE-RSA-AES256-GCM-SHA384 subject="/C=US/ST=California/L=San Francisco/O=salesforce.com, inc./OU=0:app;1:ia2;2:ia2-sp4;3:na113;4:prod/CN=na113-app2-16-ia2.ops.sfdc.net") id 1D/AC-04166-403CC846; Fri, 16 Jun 2023 20:16:04 +0000
Received-Spf:pass (mail157c40.carrierzone.com: domain of michelle_watson=intuit.com__imqucix8caxsqbsl@k6g2xi342kvgy1v7.kg26uph9bq7uuzkj.6v05.i-xs0jeac.na113.bnc.salesforce.com designates 13.110.14.222 as permitted sender) receiver=mail157c40.carrierzone.com; client-ip=13.110.14.222; helo=smtp15-ia2-sp4.mta.salesforce.com; envelope-from=michelle_watson=intuit.com__imqucix8caxsqbsl@k6g2xi342kvgy1v7.kg26uph9bq7uuzkj.6v05.i-xs0jeac.na113.bnc.salesforce.com; x-software=spfmilter 2.001 http://www.acme.com/software/spfmilter/ with libspf2-1.2.10;
Reply-To:michelle_watson@intuit.com
Return-Path:<michelle_watson=intuit.com__imqucix8caxsqbsl@k6g2xi342kvgy1v7.kg26uph9bq7uuzkj.6v05.i-xs0jeac.na113.bnc.salesforce.com>
Subject:Get to know your options with Intuit
To:"astorino@inreach.com" <astorino@inreach.com>
X-Ctch-Refid:d-sP-000000000000000000000000000000000000000000000RWD4AQ00eDVvGYQuTAKyjhh5ihX8vQ@sfdc.net
X-Ctch-Spam:mc_SUSPECT
X-Ctch-Vod:Unknown
X-Da-Pass:W0T0
X-Envelope-From:michelle_watson=intuit.com__imqucix8caxsqbsl@k6g2xi342kvgy1v7.kg26uph9bq7uuzkj.6v05.i-xs0jeac.na113.bnc.salesforce.com
X-Mail_abuse_inquiries:http://www.salesforce.com/company/abuse.jsp
X-Origin-Country:US
X-Priority:3
X-Rspamd-Result:default: False [0.30 / 6.00]; DWL_DNSWL_MED(-2.00)[intuit.com:dkim]; INTRODUCTION(2.00)[]; CTYPE_MIXED_BOGUS(1.00)[]; DMARC_POLICY_ALLOW(-0.50)[intuit.com,reject]; FORGED_SENDER(0.30)[michelle_watson@intuit.com,michelle_watson=intuit.com__imqucix8caxsqbsl@k6g2xi342kvgy1v7.kg26uph9bq7uuzkj.6v05.i-xs0jeac.na113.bnc.salesforce.com]; R_DKIM_ALLOW(-0.20)[intuit.com:s=mintsupport]; RWL_MAILSPIKE_VERYGOOD(-0.20)[13.110.14.222:from]; R_SPF_ALLOW(-0.20)[+exists:13.110.14.222._spf.mta.salesforce.com]; ONCE_RECEIVED(0.10)[]; RCVD_NO_TLS_LAST(0.10)[]; MIME_GOOD(-0.10)[multipart/mixed,multipart/alternative,text/plain]; ASN(0.00)[asn:14340, ipnet:13.110.0.0/16, country:US]; MIME_TRACE(0.00)[0:+,1:+,2:+,3:~]; FROM_NEQ_ENVFROM(0.00)[michelle_watson@intuit.com,michelle_watson=intuit.com__imqucix8caxsqbsl@k6g2xi342kvgy1v7.kg26uph9bq7uuzkj.6v05.i-xs0jeac.na113.bnc.salesforce.com]; RCVD_COUNT_ONE(0.00)[1]; HAS_X_PRIO_THREE(0.00)[3]; NEURAL_HAM(-0.00)[-0.988]; FROM_HAS_DN(0.00)[]; ARC_NA(0.00)[]; TO_DN_EQ_ADDR_ALL(0.00)[]; REPLYTO_ADDR_EQ_FROM(0.00)[]; DKIM_TRACE(0.00)[intuit.com:+]; TO_MATCH_ENVRCPT_SOME(0.00)[]; RCPT_COUNT_TWO(0.00)[2]; HAS_REPLYTO(0.00)[michelle_watson@intuit.com]
X-Rspamd-Status:No, score=0.30
X-Sender:postmaster@salesforce.com
X-Sfdc-Binding:1WrIRBV94myi25uB
X-Sfdc-Emailcategory:apiSingleMailViaApex
X-Sfdc-Entityid:0063j000017SIvK
X-Sfdc-Interface:internal
X-Sfdc-Lk:00Di0000000Xs0j
X-Sfdc-Tls-Norelay:1
X-Sfdc-User:0053j00000B2sYa
X-Spam-Flag:NO
X-Vade-Spamcause:gggruggvucftvghtrhhoucdtuddrgedvhedrgedvgedgudegjecutefuodetggdotefrodftvfcurfhrohhfihhlvgemucfjqffuvffqrffktedpgffpggdqveegtdenuceurghilhhouhhtmecufedtudenucdnffhirhgvtghtrfhrohhsphgvtghtucdludekmdenucfjughrpeffhfhrvfevkffugggtrfigsehmtdersgdttddunecuhfhrohhmpefoihgthhgvlhhlvgcuhggrthhsohhnuceomhhitghhvghllhgvpgifrghtshhonhesihhnthhuihhtrdgtohhmqeenucggtffrrghtthgvrhhnpeehfeejvddvgfeukefgjedvffetheeggefflefghfdtheegkeevfeelgefhgffgteenucffohhmrghinhepihhnthhuihhtrdgtohhmnecukfhppedufedruddutddrudegrddvvddvnecuvehluhhsthgvrhfuihiivgeptdenucfrrghrrghmpehinhgvthepudefrdduuddtrddugedrvddvvddphhgvlhhopehsmhhtphduhedqihgrvddqshhpgedrmhhtrgdrshgrlhgvshhfohhrtggvrdgtohhmpdhmrghilhhfrhhomhepmhhitghhvghllhgvpgifrghtshhonhepihhnthhuihhtrdgtohhmpggpihhmqhhutghigiektggrgihsqhgsshhlsehkiehgvdigihefgedvkhhvghihudhvjedrkhhgvdeiuhhphhelsghqjehuuhiikhhjrdeivhdthedrihdqgihstdhjvggrtgdrnhgruddufedrsghntgdrshgrlhgvshhfohhrtggvrdgtohhmpdhnsggprhgtphhtthhopedupdhrtghpthhtoheprghsthhorhhinhhosehinhhrvggrtghhrdgtohhm
X-Vade-Spamscore:18
X-Vade-Spamstate:commercial:mce
X-Whl:LR

[Amajane285]

I called Lacerte recently with similar issues.  This has happened to multiple people on our staff; where we received the follow up email with survey without actually calling in to Lacerte.  The call also doesn't show up in our Service Request History through Lacerte.  Lacerte Support didn't really have an answer for us either.