{"success":true,"data":{"id":"fake-xero-accounting-invoice-billing-phish","label":"Fake Xero / FreshBooks / Wave accounting subscription suspended or payment failed phishing — fraudulent email impersonating Xero, FreshBooks, or Wave Accounting claiming the recipient's subscription has been suspended, their account payment has failed, their invoices are inaccessible, or their payroll has been suspended — directing them to sign in, update billing, or restore access through a spoofed accounting portal — distinct from the QuickBooks/Intuit signal; Xero has 3.5M+ subscribers (dominant in UK, AU, NZ, Canada); FreshBooks 30M+ users; Wave 5M+ small businesses; when accounting access is cut, payroll stops and client invoicing fails — extreme urgency for small business owners","description":"Phishing emails impersonating Xero, FreshBooks, or Wave Accounting claiming the recipient's subscription has been suspended, their account payment has failed, or their invoices and financial data are inaccessible — directing them to sign in, update billing, or restore access. Key facts: (1) Xero has 3.5M+ subscribers and is the dominant cloud accounting platform across the UK, Australia, New Zealand, and Canada; FreshBooks has 30M+ users globally; Wave serves 5M+ small businesses with free accounting software — these are critical business infrastructure tools, not optional productivity apps; (2) When a small business's accounting platform access is cut, the immediate consequences are severe: client invoices cannot be sent or tracked, payroll runs cannot be processed, VAT/tax returns cannot be filed, and bank reconciliation fails — creating extreme urgency to restore access before financial penalties or cash flow disruption occur; (3) This signal is distinct from the QuickBooks/Intuit signal (which targets the North American small business market) — Xero is the dominant platform for UK/AU/NZ accountants and bookkeepers, many of whom manage accounts for 50+ small business clients; a compromised Xero accountant account exposes ALL their clients' financial data simultaneously; (4) The \"payroll suspended\" variant is particularly high-urgency: if the payroll run is blocked by a fake Xero suspension email and the business owner panics and clicks the phishing link, attackers gain access to payroll processing, employee bank details, and wage data. Warning signs: sender domain not xero.com, freshbooks.com, or waveapps.com; no reference to specific account subscription name, billing date, or last invoice number; urgency about data loss or payroll failure.","tier":"danger","category":"phishing","isThin":false}}