Zoho Assist Phishing Email: How to Spot and Report It

This email is almost certainly a phishing attempt, not a genuine Zoho purchase confirmation. The safest response is to avoid the phone number, links, downloads and replies, then report the message as phishing or junk and send a copy to Zoho's abuse team.

What changed

The suspicious message claims that a "Premium PC Protection Plan" was activated for $500. It includes an invoice number, transaction ID, payment status and a phone number for "customer support." It also says that installing a remote-access application would add the computer to another person's unattended device list.

That combination is a classic remote-access scam pattern. The attacker wants the recipient to believe that an expensive transaction has occurred, then call the supplied number for help. A fake support agent may ask the victim to install software, share a verification code, provide bank details or grant control of the computer.

The fact that the email appears to come from notifications@zohoassist.com does not prove that Zoho sent it. Sender addresses can be spoofed, which means a message can display a legitimate-looking address while originating elsewhere. Zoho warns that fake support operations may misuse its name, numbers and branding.

The message also contains several warning signs:

• The recipient did not request a PC protection plan.
• The stated purchase was sent to an address unrelated to the recipient's Zoho Books account.
• No matching charge appears on the recipient's cards or bank accounts.
• The message uses a generic username rather than the recipient's actual name.
• It provides a phone number instead of directing the recipient to an independently verified Zoho support channel.
• It introduces remote computer access, which is unrelated to a normal purchase receipt.
• The wording creates urgency by mentioning a large charge and a future bank statement entry.

Landing in the main inbox does not make the email legitimate. Spam filters reduce unwanted mail, but they do not identify every spoofed or newly created phishing message.

Why it matters for your business

Remote-access scams are especially dangerous for small businesses because one compromised computer can expose customer records, invoices, saved browser passwords, email sessions and accounting information.

Zoho Assist is a legitimate remote-support product, but legitimate software can be abused by criminals. Zoho's scam guidance says that unauthorized people should never receive remote access to a personal or business computer. Once remote-access software is installed and configured, the operator may be able to view or control the device.

The apparent sender is therefore only one data point. A safer verification process checks the business context, the account involved and the action requested. In this case, the recipient has no matching purchase, the email went to the wrong address and the message encourages contact through an unverified telephone number. Those facts are stronger evidence than the displayed sender name.

Zoho's published guidance also notes that caller ID names and similar identity details can be spoofed. Treat unexpected invoices, refunds, account warnings and support requests as untrusted until verified through a known website or an existing account session.

For a business, the correct policy is simple: do not use contact details supplied in an unexpected message. Open Zoho directly through a saved bookmark, review the relevant account, or use an official support channel found independently.

How to use it

1. Do not call the number. Do not reply to the message, confirm that the mailbox is active or provide any personal, payment or account information.

2. Do not click, download or install anything. The message specifically describes unattended remote access. Do not run an installer, browser download or command supplied by anyone connected to the email.

3. Preserve the evidence. Keep the original message until it has been reported. If possible, save the full email headers. Headers contain routing and authentication details that can help identify whether the displayed sender was spoofed.

4. Check your accounts independently. Sign in through your normal Zoho bookmark, not through the message. Review Zoho Books, payment accounts and bank or card statements for genuine activity. Do not rely on the invoice number or transaction ID in the email.

5. Report the message in Outlook. Use the built-in Report Phishing or Report Junk option. Reporting helps your email provider improve filtering for similar messages. Do not simply delete the email before reporting it if your mail system supports reporting from the message menu.

6. Report the abuse to Zoho. Zoho identifies abuse@zoho.com as a reporting address for inappropriate or misdirected email. Zoho also publishes abuse-reporting channels for phishing and other misuse of its services. Include the original message and full headers when the reporting system allows it.

7. Check the computer if anyone interacted with the message. If someone clicked a link, ran an installer or granted remote access, disconnect the device from the network and contact a trusted IT professional. Zoho's scam guidance recommends notifying financial providers, resetting potentially exposed passwords and having the device inspected.

8. Protect business accounts after possible exposure. Change passwords from a clean device, starting with email, accounting and administrator accounts. Enable multifactor authentication where available. Review active sessions, connected applications and new users. If payment information may have been exposed, contact the bank or card provider using the number printed on the card or shown in its official app. Consider implementing password management solutions to strengthen credential security across your organization.

9. Tell your team what happened. Share the indicators without forwarding the original message as a clickable email. Explain that a Zoho-branded sender does not make an unexpected invoice trustworthy. Give staff one approved process for verifying payments and support requests.

No matching charge is reassuring, but it does not make the message harmless. The main risk is not the alleged $500 transaction. It is the attempt to persuade someone to call a scammer or install remote-control software.

Implementation angle

An automation partner can create a safe intake process for suspicious messages without opening their attachments. For example, a monitored mailbox can route reported emails to a workflow in Make or n8n, extract the sender, recipient, subject, phone number and authentication results, then store the case in Zoho Desk or Zoho CRM for review. A controlled AI step, using Claude or another approved model, can summarize the indicators and classify the message as invoice fraud, impersonation or remote-access phishing, while keeping human approval before any reply or account action. The workflow can also alert the business owner when a message mentions remote access, payment urgency or an unfamiliar support number.

Book an AI implementation engagement with Creator Scripts at creatorscripts.com.

Frequently asked questions

Is this Zoho Assist invoice email a scam?

It is likely a phishing attempt, especially if you did not buy the plan or recognize the charge. Do not trust the displayed sender address, since email addresses can be spoofed.

What should I do with a fake Zoho purchase confirmation?

Do not call the number, click links, open downloads or reply. Report the email as phishing or junk, then check your Zoho and payment accounts by signing in through your usual route.

What if I called the number or installed remote-access software?

Disconnect the affected computer from the network and contact a trusted IT professional. From a clean device, change potentially exposed passwords, review account access and contact your bank if payment details may have been shared.