Avoid phishing scams and spoofed sites

by TurboTax• Updated 1 week ago

Phishing is tricking someone to steal their info. The bait the phisher uses to reel in is forged email, websites, or hyperlinks that look like the real thing. They'll ask for a Social Insurance number, driver's license, credit card, or bank account numbers.

Here's how to avoid getting caught.

Spoofed email address: It's easy to fake a From or Reply To address, either manually or with spam software, so never assume an email is real by looking at its header. You might be able to spot fake addresses by checking for domain name misspellings (like gogole.com, instead of google.com), but this isn't foolproof. It's best to not reply to suspicious emails and avoid opening email attachments. Some email service providers combat the problem of spoofed addresses by using authentication techniques to verify a sender's integrity.
Fake link: Scam emails can contain a hidden link to a site that asks you to enter your sign in and account information. If the email threatens you with account closure if you don't sign in soon, you could be the target of phishing. You may be able to tell if a link is real by moving your cursor over the link to see the hidden web address. It'll look different than the one you see on the surface. When in doubt, never open a link in a suspicious email.
Forged website: Phony websites mimic real sites by copying company logos, images, and site designs. Malicious websites can also use HTML, Flash, or JavaScript to mask or change a web address. If you visit a financial site, like your bank or credit card company, enter its known address into the browser location field manually. Use a browser with an anti-phishing plug-in or extension.

Note: You can help. If you suspect you have received a phishing email from someone impersonating Intuit, please report it immediately. We look into each reported instance.

There are also sites out there that offer technical support for TurboTax or other Intuit products. While many of these sites are legitimate operations, they aren't endorsed by, licensed by, or otherwise affiliated with Intuit or TurboTax. We can't and don't guarantee their services or accuracy. The best and only way to reach official TurboTax support is through TurboTax.com and our Contact Us page.

Recognizing fake emails

What we won't do

We'll never send you an email with a "software update" or "software download" attachment. When we tell you about an update, we'll tell you how to update from the product yourself or tell you to enter the website name and do it yourself. Some of our products have auto-update, which is the preferred method.
We'll never send you an email asking you to send us your user ID or password info.
We'll never ask you for your banking information or credit card info in an email. We'll never ask you for private info about your employees in an email.

What we will do

We'll provide you with instructions on how to stay current with your Intuit product and info on how to securely download an update from your computer.
If we need you to update your account info, we'll request that you do so by logging into your account or calling an official Intuit number.

Important: Not sure if it's really TurboTax behind that email? We can help. For the latest info on known phishing scams and how to report suspicious emails, visit our Online Security Centre.

Common questions

Q: If I think an email is suspicious, what should I do?

A: Report any suspicious emails to us.

Q: Where can I look for info about suspicious emails to find out if they are real?

A: Check the Intuit Online Security website to review any known phishing emails or details about other security issues.

Q: How secure is my personal info using your online services?

A: The privacy and security of our customers' data is of the highest importance to us and we consider it key to maintaining customers' trust. We employ industry-recognized security safeguards to help protect the private info you provide us from loss or misuse.

Q: Does Intuit sell or share their customer lists?

A: Intuit doesn't rent, sell, or share our customers' personal info with anyone outside of Intuit for their promotional use.

Q: Why am I getting a password reset e-mail for somebody else?

A: At Intuit, we allow customers to create user IDs for many of our services. If a customer forgets their password, we'll only allow the change to be authorized by the email address on record. If it appears that someone entered your email address in error, it's mostly likely by accident, in an attempt to reset their password. As a result, you received the email, which is how the process is supposed to work. This is one of the ways we stop unauthorized access to users' accounts. The other user most likely has an email address similar to yours or hit a key incorrectly when trying to get their password reset. You can also receive email from Intuit if an email address is shared or used by others in your household.

Q: Why was I told that you can't delete my email address from your database?

A: Unfortunately, for record-keeping and legal purposes, we can't delete email addresses. We can, however, block your email address, so you no longer receive promotional communications from us. We respect your choice not to be contacted for promotional reasons such as marketing. However, sometimes it's necessary to inform our customers about critical matters that could affect the use of their software, service or subscription. Due to the financial nature of our products, customers can't opt out of receiving these critical service notifications. We take care to limit these notices only to customers affected by the issue.

Q: Where can I opt out of receiving marketing emails?

A: You can manage your contact options by visiting us at Privacy Preferences.

Q: I opted out of marketing contacts from Intuit, why am I still getting emails?

A: Your choice to opt-out only applies to promotional materials and not critical service notifications that could affect your service or software. We respect your desire to not be contacted. We notify our customers about critical service notices because it may be necessary to contact customers to notify them about a subscription expiration, provide order info such as confirmations, or alert them to an issue with a service or software that could negatively affect their continued use. Due to the financial nature of our products, customers can't opt out of receiving these critical service notifications. We take care to limit these notices only to customers affected by the issue. If you have more than one email address, you can opt out of one and not the other(s).

Q: Why do you require me to provide my information when I go to opt out?

A: We place the highest value on customer privacy. To verify that we're correctly honouring your contact preferences, we must verify your contact info so that we can correctly match and update the appropriate customer account in our database. After locating and updating your record, we'll flag it so that it won't be included in future marketing lists as indicated in your request.

Q: Who oversees Intuit’s privacy policies to assure they meet certain standards?

A: To give you confidence in our privacy practices, we've obtained the TRUSTe Seal. TRUSTe reviews designated Intuit Web sites and evaluates our privacy practices. More information about the TRUSTe Seal

Q: Who can I contact if I have security questions?

A: Reach our Security Team by email at security@intuit.com.

Q: Who can I contact if I have privacy concerns?

A: Reach our Privacy Team by using our online form or by visiting Privacy & Security. You can also send postal mail to:

Privacy Team

Intuit Inc

2800 East Commerce Centre Place

Tucson, AZ 85706