Your Xero Invoice INV-0003677

Do NOT click to view your bill – you will be taken to a site with malware.

This email has nothing to do with xero.com, which is a perfectly legitimate website.  Look at the links in this email.  The information ones (help, question, update) take you to the real website.

BUT – the “view your bill” link does NOT take you to the Xero website – it takes you to sharepoint.com

Now look at the email address this email claims to come from.  subscription.notifications@xeronet.org

I looked up xeronet.org – it was registered today (16 Aug 2017) to someone in China.  Here is the who.is information

Dear Client

Here’s your Xero subscription invoice for the previous billing period.

View your bill: INV-0003677

You’ve already provided us with your payment details so unless advice to the contrary is received from you by 23 Aug 2017, the amount will be debited from your credit card on or after 26 Aug 2017.

Need help updating your payment details or understanding how Xero bills you? Click here
Need help with your online subscription invoice? Click here
Need a question answered about Xero? Ask it here

Regards,
The Xero Billing Team