A past due invoice is the kind of mail a bookkeeper actually opens, because QuickBooks already lives next to the bills that keep a small shop from stalling on a Friday. The subject in this case is Invoice #INV- Payment Overdue, which is short enough to survive the few seconds between the inbox list and the reading pane. A truncated invoice number next to the word overdue is enough of a books errand to look like work you already meant to finish before lunch.
The body writes as a PAYMENT OVERDUE NOTICE from a Billing Department, greets you as Dear QuickBooks user, and says the records indicate that your invoice is now PAST DUE. It asks you to make the payment immediately to avoid late fees and service interruption, then it offers a single green control labeled Download Invoice Now. Under that button it lists Credit Card, PayPal, Bank Transfer, and Bitcoin as accepted methods, and it tells you to disregard the notice if you have already paid. The sign-off is Thanks, QuickBooks Team, which is how paperwork talks when it wants to sound like a system instead of a stranger asking you to fetch a file.
If you need to know whether anyone actually billed you, you check the thread you already have with that vendor, or you open the books the way you already do. A real invoice, when one exists, is still sitting in the company file you already use, and it will still be there after you leave this letter alone.
Overview
The letter wants you to treat an overdue books invoice as a file you must download right now, then it uses Download Invoice Now to choose the next page for you. That next page copies a Microsoft SharePoint Online document portal, complete with a spreadsheet sitting in the background as if a real workbook were waiting behind a login. A dialog overlays that fake sheet, shows SharePoint Online and Microsoft marks, pre-fills an email address, and asks you to Enter Email Password so you can VIEW DOCUMENT. What they take first is the login for the inbox you are sitting in, and after that they take the inbox itself, including the threads with vendors and the reset codes that land an hour later. The overdue-invoice story is costume for that harvest, because late fees and a threatened service interruption are the kind of errand a tired desk will finish before asking whether QuickBooks actually sent the note.
Intuit remains a real company and QuickBooks remains a real product, and that fact is why the name is useful on a From line that wants to look like accounts payable. Anyone can type QuickBooks Team into a display name, which means a green bar and a Billing Department heading do not prove that an invoice was issued or that anyone at Intuit asked you to pay from this message. Microsoft remains a real company and SharePoint Online remains a real workplace product, and copying those marks on a later page does not mean Microsoft asked you for a mailbox password either. People who steal inboxes borrow letterhead from software that already sounds like invoices, late fees, and shared files, because they want you to treat the note as a chore you already meant to finish.
Official books live inside the product after you type quickbooks.intuit.com yourself, on a page you already use rather than on a page a cold letter chose for you. A surprise overdue notice is a poor substitute for that door, because QuickBooks does not collect a mailbox password in order to show you an invoice you supposedly already owe. If a later page also asks for a code from your phone, they will take that too, since the login is what they designed the past due story around.
The Download Invoice Now click did not open Intuit, and it did not open a SharePoint library that belongs to your workplace. It opened a Fastly page dressed as SharePoint Online, with a workbook painted in the background so the overlay would feel like a document portal instead of a password box. I am not going to paste the rest of that hostname, because those pages move, and a copied link is how the next person gets hurt. The quieter tell is the habit: a past due invoice that demands a mailbox password is not an invoice, and a VIEW DOCUMENT button on a copied SharePoint dialog is not a books file.
The letter claims an overdue invoice of $847.50, which is a round enough figure to feel like a real bill and a small enough figure to feel like something you might pay without calling anyone. A truncated Invoice #INV- heading never names a customer, a purchase order, or a date that matches a line you can find in the company file without this email. Dear QuickBooks user is a greeting that would fail a real books desk, because the product you already pay already knows the company name it prints on every other notice. Bitcoin sitting next to Credit Card and PayPal is another leftover from a kit that wants every payment rail at once, which is not how a QuickBooks invoice usually talks when a vendor actually billed you.
The Federal Trade Commission describes this shape in ordinary language in How To Recognize and Avoid Phishing Scams, where it says scammers use email to steal passwords, account numbers, or Social Security numbers. A common story, the Commission adds, is a problem with an account when there is no problem, or a document you must confirm when you do not. The Commission’s advice is to contact the company with a phone number or website you already know is real rather than with the information in the email. A Download Invoice Now button that arrived inside an unexpected past due notice is information in the email, which is why it is a poor place to start a payment.
CISA says the same thing from the systems side on Avoiding Social Engineering and Phishing Attacks, where it tells people not to reveal personal or financial information in email, and not to follow links sent in email when a message asks for that information. On Teach Employees to Avoid Phishing, CISA tells staff that if a message feels off, they should verify it without using any phone number or link in the message, which means using a number you already have and a site you already type. That habit is the opposite of fetching an overdue invoice from a letter you did not request, and it is the opposite of typing a mailbox password so a SharePoint overlay can supposedly unlock a workbook.
Download Invoice Now is the click
Read the button the way a tired bookkeeper reads it between two other alerts, because Download sounds like a file you already own and Invoice sounds like a bill that is already in motion. The subject has already done the overdue work, the PAST DUE line has already done the calendar, and the late fee warning has already done the money, so by the time your eye hits the rectangle the errand feels mostly finished.
A real QuickBooks invoice does not need that rectangle in a surprise email, because if a bill actually posted, it would already be visible after you open the product yourself. What the button actually does is take you off the inbox and onto a page the sender controls, and on a phone, where hovering is awkward, many people never see the real destination before the next page fills the display.
A past due notice is borrowed panic
Keep the names straight, because the campaign depends on mixing them up: Intuit exists, workplaces already use QuickBooks to send invoices, and a past due notice is a believable thing to put next to a Friday close. Dear QuickBooks user, a claim that records show an invoice is PAST DUE, and a Billing Department sign-off are doing the work a real reminder usually does, so a finance person can picture a vendor waiting without checking whether anyone at Intuit issued that file.
Those details can be typed by anyone who has seen a books reminder, and matching them to a real invoice is work the letter hopes you will skip because the subject already looks like money. Display names are cheap, and anyone can set a From line to read QuickBooks Team, just as anyone can paste a PAYMENT OVERDUE NOTICE heading under a green bar and date the whole thing on a Friday morning. Microsoft’s guide to spotting phishing tells you to treat mismatched senders as a warning and to slow down when a message wants an immediate click. A footer that hurries you toward late fees and a service interruption is that kind of click, so do not reply to ask whether the invoice is real, because a reply teaches them the inbox is live and it lands wherever they pointed the return path.
The overlay copies SharePoint
After Download Invoice Now, the story changes, because the inbox promised an invoice while the next screen promises a document portal that looks like SharePoint Online. The background is dressed as an Excel workbook so you will believe a file is already open behind glass, and the overlay then asks for the email password as if that were the ordinary way a workplace unlocks a shared sheet. Your address may already be sitting in the box, the colors look familiar, and VIEW DOCUMENT is the language you see when a real library actually holds a file, which is how a careful person finishes a login they never meant to start.
A padlock in the browser does not fix that, because encryption only means the path is private and does not mean the person at the other end is Microsoft, Intuit, or your own workplace. HTTPS can wrap a stolen password as neatly as a real one, and an accurate logo is not a certificate, so you trust the complete domain and the way you reached it rather than the artwork inside the page. Google’s advice on phishing in Gmail is blunt on this point: Gmail will not ask you for your password over email, and if an invoice click then presents a login, you should not type it. Do not finish that form to see whether a workbook then appears, because a copied SharePoint overlay does not become safer when you only wanted to look at a past due bill.
How The Scam Works
1. An overdue invoice lands
It arrives in the same Outlook or Gmail you already trust, wearing a subject that is Invoice #INV- Payment Overdue, which is how a books product talks when it thinks you already know the bill. The display name presents itself as QuickBooks Team, and the whole note is built to fit on a phone screen as a courtesy an accounts payable person already expected rather than as a midnight threat to delete the mailbox.
If you are already signed in to webmail, the folders on the left and the search bar on the top make the fake note feel native. You are not visiting a strange site yet, because you are only reading mail, and the letter only has to survive the few seconds between the subject and Download Invoice Now. A PAST DUE heading next to a Billing Department line is enough to buy those seconds inside a finance folder, especially on a Friday when late fees already live in the back of someone’s mind.
2. The name copies QuickBooks
QuickBooks belongs to a real product that workplaces already use to send invoices and record bills, and that fact is the load-bearing detail in a letter that only has a few seconds to look like a past due notice. When you have ever forwarded a reminder, printed an aging report, or seen Intuit on a closing checklist, you fill in the rest yourself. Even if you have never opened the product, the phrase Payment Overdue still sounds like money someone is waiting on, which is enough of a reason to open the note.
The people who wrote the letter did not need to sit inside Intuit to borrow a PAYMENT OVERDUE NOTICE heading, a Billing Department footer, and a Thanks, QuickBooks Team sign-off that would survive a five-second glance. The thief is only inside your inbox if the download click works, which is why the name on the letter is doing borrowed work rather than proving a bill was issued. A Dear QuickBooks user greeting that never uses your company name is a cheap leftover from the same kit, not proof that a clerk already knew who you were.
3. Late fees are the hurry
Late fees and a threatened service interruption are doing the work a missed close usually does, because money that might stall is a Friday a finance person already fears. An invoice can wait until after lunch when it is only paper, which is why the letter does not lean on paper at all. A late fee that grows while you hesitate, and a hint that the product itself might stop, feel like a problem you should finish before the next meeting starts.
Accounts payable teams live on that kind of clock, because vendors send reminders, controllers ask for dates, and a past due bill that posted without a conversation is a real kind of afternoon. The lure is borrowing that afternoon, and it does not need a long pitch when it can offer a PAST DUE line, a Download Invoice Now button, and a list of payment methods a tired person can already imagine matching to last week’s vendor. A shop owner who thinks the books software might go dark, a bookkeeper who thinks a vendor will stop shipping, and a controller who thinks a late fee will hit the close are all stories the subject can invent in a few seconds.
4. Download Invoice is the handoff
You click Download Invoice Now because that is what a past due notice is for, and because late fees make a bill feel like an errand you should finish before lunch. Then the next page asks you to sign in as if you were opening a shared workbook instead of showing an invoice with a number you can read back to a vendor.
That request is the tell, because you are already in mail, and a real invoice would open inside the product after you typed it yourself. It would not ask you to prove you are you so you can see a bill the sender already claimed was past due. CISA’s advice is not to follow a link in a message that then asks for that kind of information, which is why Download Invoice Now is the detour rather than a file. The button is a handoff from a letter you trust to a page you should not, and the invoice you were promised never had to exist for that handoff to work.
5. The page copies SharePoint
The page that follows is dressed as SharePoint Online, often with a spreadsheet in the background, a Microsoft mark on the overlay, and a field that says Enter Email Password instead of a books login. The costume is specific on purpose, because a workplace that already stores invoices in SharePoint will treat a document portal as the ordinary next step after a Download Invoice click. VIEW DOCUMENT sits under the password box the way a real library talks when a file is actually waiting, which is how the overlay keeps looking like work you already do.
Do not finish that form to see whether it is real, because a copied SharePoint overlay does not become safer when you only wanted a past due bill. Do not send the live button to a coworker so they can check the invoice, and if you need a second pair of eyes, send a screenshot with the link unclicked, or send the raw message as an attachment to a person you already know. A padlock, a green header, and a PAST DUE line you already feared are not a reason to type the secret that opens the rest of the week.
6. They want the mailbox password
If you type the password they have the first key, and if a text, an authenticator prompt, or an email code arrives while that tab is still open they want the second key too. The story will sound helpful, asking you to confirm so the document can load, or to enter the code to verify your work account so VIEW DOCUMENT can finish. Each line is the same request for access to the mailbox you were already sitting in, because the overdue invoice was never sitting behind that box. The people who wrote the letter designed the PAST DUE line so you would not notice the swap from a books file to a mailbox login.
Microsoft’s phishing page tells you to change the password on every affected account if you think you typed it on the wrong site, and to turn on multifactor authentication if it is not already on. That is the same advice the FTC gives in consumer language when a password may already be sitting with someone else. Once they can open the account they are not hunting for a past due invoice inside SharePoint, because they are reading the last bill you sent, the last bill you received, and the thread with a vendor who pays by wire, and then they write the next message in your voice. A compromised mailbox is not a nuisance in that setting, because it is a way to move a payment without ever calling you again.
7. A second crew sells recovery
The last move is often social, and it may not even be the same people, because a day later you can get a call, a text, or a fresh email that already knows you opened a QuickBooks overdue notice. They will offer to lock the invoice, pull the workbook, or stop a late fee you never owed, and then they will ask for a code, a remote-access session, a second password, or a cleanup fee. Hang up, because a stranger who found you is not your incident responder, and a QuickBooks security desk that called you after Download Invoice Now is not Intuit.
That is why a quiet admission that you already clicked, even if you did not pay anyone, is not the end of the story, because you may not have paid while the person who trusts you might. Tell the people who send you money and the people you pay, and tell a real vendor, if you actually share a bill, on a number you already have rather than on a number that arrived after Download Invoice Now. A 30-second call from you is cheaper than a week of wires that look like your week, and the second crew is counting on shame to keep you quiet long enough for the first crew’s mail to land.
What To Do If You Have Fallen Victim to This Scam
If you only opened the email and closed it, you are not finished, but you are not doomed, and if you pressed Download Invoice Now and then typed, treat the account as touched and move in this order. Speed beats waiting to name the exact kit they used, because the goal is to take the mailbox back before someone else sends the next invoice in your name. Write down what you remember before the details fade, then stay on official pages you open yourself rather than on anything that arrived inside the overdue letter.
- Write down what you typed, including the time and the subject Invoice #INV- Payment Overdue, then stop using that tab. Write down whether you entered a password and whether you approved a code or an app prompt, then close the SharePoint-looking page. Do not keep checking it to see if an invoice appears, and do not forward the live button to a friend so they can look. Send a screenshot with the link unclicked, or send the raw message as an attachment to a person you already know.
- Open your real mail yourself in a new tab you type, then change the password to one you have not used anywhere else. Use the official site or the app you already trust, and do not return to the overdue letter for a reset link. If this is a Microsoft account, follow Microsoft’s published steps to recover a hacked or compromised Microsoft account from a page you open yourself. If you cannot sign in, use the official reset path, and if this is Gmail or a workplace portal, open that product the same way, from an address you typed.
- Sign out of other sessions everywhere you can, then turn multifactor authentication back on before you do anything else with the mailbox. Review recent sign-in activity on that official page and sign out of every session you did not start yourself. If you approved a prompt you did not begin, assume that session is not yours until you kill it, and remove recovery phones and recovery addresses you did not add. A password change that leaves an old session running is only half a change, because the other login can keep reading mail. If you reuse that password on banking, payroll, or QuickBooks, change those on their own sites too, after you type those sites yourself.
- Look for inbox rules, automatic forwarding, and mail that left without you, because those are the quiet ways a stolen mailbox keeps working after a password change. Check the Sent folder and look for a new mailbox delegate, a new app that can read mail, or a filter that hides replies. Delete the rules and delegates you did not create, and search the mailbox for other Payment Overdue notices you did not expect. If this is a work account, call IT before you spend an hour hunting, because they can dump sessions and pull the audit faster than you can.
- Call the people who pay you and the people you pay, using a number from last year’s invoice, a card in the drawer, or a listing you already trust. Tell them a fake QuickBooks overdue notice tried to take the mailbox, so they should not honor a new account number or a rushed updated-wiring note that arrives this week. If you actually share a vendor file, say that out loud on a number you already have, because the lure picked a books name for a reason. A coworker who already paid according to this letter still needs a human check in the real product.
- Tell the bank the same day if invoices, payroll, or deposit files live in that inbox, and ask them to watch for a change-of-account request. Call any payroll or processor vendor as well, because a charge you did not make and a transfer you approved because a message looked like you are different problems, and time still matters on both. Do not invent a dollar figure for a loss you have not seen, and report what you actually typed and what you actually see on the statement. If you use QuickBooks and a real invoice is waiting, open that product yourself and look there, not in this email.
- Report the email through the controls your mail product already publishes, then scan the device if Download Invoice Now saved a file or pushed a viewer. In Outlook, use Report and then Report phishing, the path Microsoft publishes on its phishing help page, and in Gmail use Google’s reporting control from the same phishing help page they publish for this. Forward a copy to the Anti-Phishing Working Group at reportphishing@apwg.org, then file the same facts at the FTC’s ReportFraud site and, if you want a law-enforcement copy, at the FBI’s IC3. If a password, a bank account, or a Social Security number went into that page, use IdentityTheft.gov for the next steps. If a file landed, run a full scan with Malwarebytes or the antivirus you already keep updated, remembering that the scan does not get a password back and the password change does that.
If someone forwarded you the note, send them this page instead of the Download Invoice Now button, because these overdue notices travel in office threads when they look like work, which is part of how they move. Do not install a new cleaner you just searched for because a follow-up email recommended it, since that search is how people add a second problem. The recovery call that already knows the subject line belongs to the same family as step seven above, so hang up and stay on the official path you opened yourself.
If you use QuickBooks every day, treat this letter as a reminder to open the product from a bookmark you already keep, not from mail, and look at the real invoices waiting in the company file. If the product shows no past due bill, then no past due bill was issued, and if something did land, it will still be there after you ignore Download Invoice Now. A fake overdue notice does not become real because you were waiting on a vendor, and waiting is the opening they wrote the subject for.
The Bottom Line
A note whose subject is Invoice #INV- Payment Overdue, writes as a PAYMENT OVERDUE NOTICE, greets you as Dear QuickBooks user, and offers Download Invoice Now, is a login behind a books reminder. It threatens late fees and a service interruption, lists Bitcoin beside ordinary payment rails, and then opens a SharePoint Online overlay that asks you to Enter Email Password so you can VIEW DOCUMENT. The product name belongs to a real company, while the operator of this letter does not, and Microsoft is not asking you for a mailbox password from a fake document portal either. The click is the door they built so you would type a mailbox password instead of opening the books yourself, and after that they use the inbox to write as you. The recovery call that already knows the subject is the second shift, and it is not a reason to stay quiet.
Open the mail service you already pay by typing it yourself if you need to know whether anything is wrong. If you need to know whether an invoice actually landed, open QuickBooks the same way, from a site you already type, rather than from a Download Invoice Now button in a cold letter. If you already typed the password, change it on the provider’s own page, kill the other sessions, and tell the people who send you money before the next email goes out as you. The overdue invoice was never the point of the letter, because the mailbox was what they came to collect.
