Your Xero Invoice INV-0003677
Do NOT click to view your bill – you will be taken to a site with malware.
This email has nothing to do with xero.com, which is a perfectly legitimate website. Look at the links in this email. The information ones (help, question, update) take you to the real website.
BUT – the “view your bill” link does NOT take you to the Xero website – it takes you to sharepoint.com
Now look at the email address this email claims to come from. subscription.notifications@xeronet.org
I looked up xeronet.org – it was registered today (16 Aug 2017) to someone in China. Here is the who.is information
Dear Client
Here’s your Xero subscription invoice for the previous billing period.
View your bill: INV-0003677
You’ve already provided us with your payment details so unless advice to the contrary is received from you by 23 Aug 2017, the amount will be debited from your credit card on or after 26 Aug 2017.
Need help updating your payment details or understanding how Xero bills you? Click here
Need help with your online subscription invoice? Click here
Need a question answered about Xero? Ask it hereRegards,
The Xero Billing Team
August 16, 2017 @ 4:32 pm
I got this one too today. I have written to Xero to confirm but have not opened the zip file.