Very similar to if you were to send a traditional paper letter in an envelope with a stamp, and put an incorrect return address on it. You could even make it look exactly like something the real company would have sent. There is no validation of the return address. If the recipient were to respond to the return address, it would expose the ruse. The scam is that the contents of the letter have further instructions that lead to the scam.

Another complication is that the From address in internet email contains an address part and a description part. The address part is what is actually used to route the email, and the description part can be anything, including something that looks like an email address that doesn’t match the one in the address part. Most email clients only show the description part and hide the address part.

For example:

From: “Bob Smith” <[email protected]>

From: “[email protected]” <[email protected]>

From: “Do not reply” <[email protected]>

From: “[email protected]” <[email protected]>

Edit: formatting

E-Mail is old. So old that when it was invented, “hacking” and “security” was not really something anybody thought about.

To send an email you connect to the recipients mail server and type in all the data of the mail. Including recipient, subject, mail body and importantly the address displayed in the “from” and “reply to” fields. They are all defined by the sender. The Email protocol has no way to verify if this information is correct and the sender is actually part of the aledged domain.

Today, when you send a mail, most of the time you will not connect to the recipient mail server directly, but to a “sending” mail server, which then sends the mail to the recipient. For example if you log in to gmail, you write the mail on a google Mailserver which sends it to the recipient. Or you connect to your companies exchange through outlook.

There is a modern extension to the mail protocol, which allows a domain owner to define the sending mail server which is allowed to send mails on behalf of this domain. But it is in the responsibility of the receiver to check. (Its called sender policy framework SPF)

So most likely intuit didn’t do anything and the scamer just send mail without a sending mail server. And your receiving mail server did not verify the SPF correctly. Or intuit did not define an SPF. Or they did but it allows sources that do actually not belong to intuit but might be controllable by the scammers. This can happen if they want to send mails from cloud hostet systems and include them in their SPF, which may include systems by other customers of the cloud hoster.

If you want to verify mail yourself, look in the mail headers (often called: view source) and look at the “received” headers. They deta the full path the mail has taken including which system initially wrote the mail. They are ordered bottom to top, so the (chronologically) first entry is the lowest. Check if the ip adress/hostnames for the first few hops belong to intuit and if they don’t, its most likely spam.

TLDR: what is necessary to send mails from somebody else’s domain? Nothing. You can just do that. Mail is insecure by design and should be abolished.

They use spoofing. Apparently incorrectly secured stuff can allow it. The security guys at work were talking about this kind of thing the other week. I don’t fully understand it myself but this website discusses it. https://abnormalsecurity.com/glossary/dmarc