The IT Nerd

It’s been a while since I got a scam email that was either new or different. But I finally have one that I would like to present to you. This one is using the Intuit brand and looks like this:

There’s some things that I would like to highlight about this scam email:

• The email address that it was sent to was in the body of the email. That shows that the threat actors are trying with this scam.
• The threat actors create a sense of urgency by saying things like “The debited amount will be reflected within 24hrs in your banking statement” and “If you didn’t authorize this charge, You have 24hrs.”
• The quality of the English in this scam email is better than normal, but it still highlights the fact that the threat actor that is creating this email does not natively speak English.

Another thing to note is that this email didn’t come from an Intuit email address:

Intuit as a company doesn’t use iCloud to send and receive email. So that should be the big hint that this is a scam and you should delete the email immediately and move on with your life. But seeing I am not most people, I wanted to see what this scam was all about. Though I assume that it’s the usual refund scam which goes like this:

• You get an email in your inbox saying that services that you know that you don’t have are being renewed, and the money has been debited from your bank account. 
• You then call the phone number provided to dispute this.
• The scammer talks you into getting remote access to your computer where they have you fill out some sort of form to get a refund for this purchase that you never made. Fun fact: The form that the scammers will have you fill out will ask for a lot of your personal information which can later be used to steal your identity. 
• The scammer will then have you check your bank account using your bank’s online services to see if you got your refund. But the scammer will use some sleight of hand to make it look like that they massively overpaid you. And then the scammer will blame you for that. 
• You will then be bullied into refunding the overpayment by buying cryptocurrency or gift cards to send to them electronically. Assuming that they just don’t steal your money straight from your bank account themselves, or have you go to your bank to transfer the money to them, or withdraw it in cash and have you send it to an accomplice via a courier. 

So I did what you should never, ever do, which is call the number in the email. However the number was disconnected when I did. It is possible that it was shut down by the threat actors by the time I called, or it got shut down. Either way, they’ll likely pop up with with another number to try and perpetrate this scam. But my best advice to avoid this sort of scam is if you don’t have a product or service from the company that you’re receiving the email from, delete the email and go on with your life.

This entry was posted on June 9, 2023 at 12:51 pm and is filed under Commentary with tags Scam. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.