![\"\"](\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2025\/02\/scam-email-letter-emoji-600x300-1.jpg\")
<\/p>\n<\/p>\n
Throughout the past couple of years, we’ve continued to see more and more scams that leverage fake invoices or payment requests. Scammers often send them via legitimate services, such as Intuit QuickBooks, PayPal, Venmo, or Docusign to bypass e-mail spam filters.<\/p>\n
The latest round of scams uses alleged payment requests or subscription purchases. Scammers may send these scams via one of the aforementioned services, or Payoneer, or even directly from Microsoft.<\/p>\n
Here’s how you can recognize, avoid, and report these scams.<\/p>\n
First, let’s take a look at what a fake invoice or money request sent via Payoneer looks like.<\/p>\n
![\"Apple](\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2025\/02\/Apple-Inc-sent-you-a-payment-request-Payoneer-email-scam.jpg\")
“Apple Inc is requesting a payment… Here are the details of the payment request” fraudulent e-mail<\/p><\/div>\n
If you get a payment request via Payoneer, the From address will be NoReply@payoneer.com and the subject will be something like “Apple Inc sent you a payment request.” But that doesn’t mean that the invoice or money request is legitimate; scammers often leverage real services like Payoneer to send scams.<\/p>\n
First of all, if you don’t have any business relationship with the person or organization who allegedly sent the invoice, that should be your first red flag. Second, the amount is sometimes (but not always) scarily high; the main point of this is to cause the recipient to panic and act rashly.<\/p>\n
And third, pay close attention to the “Description” section. In the example above, the note from the payment requestor says, “Your iPhone 16 Pro Max order is processed via PayPal. Due to security updates, transactions now use Payoneer. Contact PayPal at 1(888) 651-[redacted] for assistance or Payoneer to track your order.” The phone number belongs to the scammer who sent the message\u2014NOT to Payoneer.<\/p>\n
Next, let’s take a look at another scam that might on the surface appear to be very different, sent directly via Microsoft. In a moment, we’ll explain how these two scams are related.<\/p>\n
![\"Microsoft](\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2025\/02\/Microsoft-subscription-purchase-confirmation-details-email-scam.jpg\")
“Details of your subscription purchase [from] Microsoft 365 admin center\u2026 Pay now” fraudulent e-mail<\/p><\/div>In this case, the subject line says simply, “Microsoft subscription purchase confirmation.” A separate e-mail, sent around the same time, has the subject line, “Get started with your new Power BI Premium Per User subscription.” The From address for both emails is microsoft-noreply@microsoft.com.<\/p>\n
How can you tell that this e-mail is fraudulent, if it really did come from Microsoft? Pay close attention to the supposed “Organization name,” which instead contains a ridiculously long and deceptive message:<\/p>\n
Organization name: (Microsoft Corporation) .Your subscription has been successfully purchased for 689.89 USD using your checking account. If you did not authorize this transaction, please call 1(888) 651-[redacted] to request a refund.<\/p><\/blockquote>\n
Like with the Payoneer variation of the scam, this phone number won’t actually go to a legitimate customer support center. Rather, the scammer operates these phone numbers.<\/p>\n
What is the common link between these scam e-mails?<\/h3>\n
While it might not be immediately obvious, both of these fraudulent e-mails are related and come from the same ring of fraudsters.<\/p>\n
How can you tell? Take a look at the “To” e-mail address for both e-mails; it’s the same address, ending in @[redacted].onmicrosoft.com. What does this mean? It means that the e-mail address where you’re receiving these scam messages has been added to an e-mail distribution list group, as part of a Microsoft Office 365 for Business organization operated by the scammer.<\/p>\n
A large number of people\u2014including potential victims whose external e-mail addresses have nothing to do with the “business” domain set up by the scammers\u2014can potentially be added to such an e-mail spam list.<\/p>\n
Eventually, when Microsoft discovers that the Office 365 business domain is being used for fraud, they’ll likely shut it down; however, it may take some time before that happens. In the mean time, recipients of these scam e-mails may fall for some of the payment requests and get tricked into sending the scammers money. After Microsoft eventually shuts down the business domain, the scammers will simply create a new one and start all over again.<\/a><\/p>\n
How can I report these scammers?<\/h3>\n
Here’s a quick chart of some legitimate organizations that are often exploited to send fraudulent e-mails. If you get fake invoices, payment requests, or subscription purchases that appear to have been sent by one of these companies, you can forward the e-mail to the relevant addresses below to report the scam:<\/p>\n