◆ kanex-ai
Loading…
Inbox Urgent Legal Staff Family Sent Attachments Sydnee.ai Spaces Unsure Later Trash
Benjamin & Williams Aug 16 5:02 AM
Commercial Claim Discovery Documents Our file:D-8222 Debtor: VICTORIA ROPA ELEGANTE
Fake debt collector demand with 24h payment threat; sender domain suspicious.
phishing urgent
Sydnee Agent (AI) Aug 16 4:10 AM
Sydnee nightly — config_drift audit 2026-08-16 — 0P0 12P1 4R
Sydnee Agent (AI): Sydnee nightly — config_drift audit 2026-08-16 — 0P0 12P1 4R
employee high
Sydnee Agent (AI) Aug 16 3:15 AM
Sydnee WEEKLY (cross-cutting) audit 2026-08-16 — 0P0 0P1 0R
Sydnee Agent (AI): Sydnee WEEKLY (cross-cutting) audit 2026-08-16 — 0P0 0P1 0R
employee high
Kelvin Yan Aug 16 1:16 AM
RE: Cash-out refinance inquiry — confirmed HOA figure, plus a second Veer question
⚠ PHISHING: employee impersonation: display name matches 'kelvin yan' but sender is email.sydneeinc.com
phishing urgent
Kelvin Yan Aug 16 1:13 AM
Re: Furnished 1BR at Veer Towers / CityCenter — owner inquiry, immediate move-in
⚠ PHISHING: employee impersonation: display name matches 'kelvin yan' but sender is email.sydneeinc.com
phishing urgent
Sydnee Inc Legal Aug 15 7:55 PM
TEST — Veer 304E, how the Izeal reply will look
⚠ PHISHING: domain impersonation: display name contains 'sydnee' but sender is email.sydneeinc.com
phishing urgent
Sydnee Inc Legal Aug 15 7:46 PM
Veer Towers 304E - furnished 1BR, corporate housing
⚠ PHISHING: domain impersonation: display name contains 'sydnee' but sender is email.sydneeinc.com
phishing urgent
Kelvin Yan Aug 15 7:34 PM
Veer 304E — three drafts for review before sending
⚠ PHISHING: employee impersonation: display name matches 'kelvin yan' but sender is email.sydneeinc.com
phishing urgent
Bank of America Aug 15 5:44 PM
Your statement is available
Bank of America: Your statement is available
financial
Bank of America Aug 15 5:43 PM
Your statement is available
Bank of America: Your statement is available
financial
Sydnee Agent (AI) Aug 15 5:39 PM
[Calibration Daily] 2026-08-16
Sydnee Agent (AI): [Calibration Daily] 2026-08-16
employee high
Sydnee Inc Legal Aug 15 5:34 PM
Access test 1 of 3 - link
⚠ PHISHING: domain impersonation: display name contains 'sydnee' but sender is email.sydneeinc.com
phishing urgent
Sydnee Inc Legal Aug 15 5:33 PM
Access test 3 of 3 - verified
⚠ PHISHING: domain impersonation: display name contains 'sydnee' but sender is email.sydneeinc.com
phishing urgent
Sydnee Inc Legal Aug 15 5:09 PM
Access test 3 of 3 - verified
⚠ PHISHING: domain impersonation: display name contains 'sydnee' but sender is email.sydneeinc.com
phishing urgent
Sydnee Inc Legal Aug 15 5:09 PM
Access test 1 of 3 - link
⚠ PHISHING: domain impersonation: display name contains 'sydnee' but sender is email.sydneeinc.com
phishing urgent
Sydnee Inc Legal Aug 15 4:48 PM
Access test 1 of 3 - link (opens straight away, no code)
⚠ PHISHING: domain impersonation: display name contains 'sydnee' but sender is email.sydneeinc.com
phishing urgent
Microsoft Outlook Aug 15 4:47 PM
Undeliverable: FW: Dr Cat's Video Insights on $NOW and $TEAM-Video 2 of 12 (August 16, 2026)
Microsoft Outlook: Undeliverable: FW: Dr Cat's Video Insights on $NOW and $TEAM
employee high
Microsoft Outlook Aug 15 4:46 PM
Undeliverable: FW: Dr Cat's Video Insights on $ABCL-Video 3 of 12 (August 16, 2026)
Microsoft Outlook: Undeliverable: FW: Dr Cat's Video Insights on $ABCL-Video 3
employee high
Sydnee Inc Legal Aug 15 4:26 PM
Veer 304E - all three access levels
⚠ PHISHING: domain impersonation: display name contains 'sydnee' but sender is email.sydneeinc.com
phishing urgent
Sydnee Inc Legal Aug 15 4:16 PM
Veer 304E - replacement links
⚠ PHISHING: domain impersonation: display name contains 'sydnee' but sender is email.sydneeinc.com
phishing urgent
Sydnee Inc Legal Aug 15 4:10 PM
Veer 304E - short links, one with a code
⚠ PHISHING: domain impersonation: display name contains 'sydnee' but sender is email.sydneeinc.com
phishing urgent
Sydnee Inc Legal Aug 15 4:04 PM
Your access code
⚠ PHISHING: domain impersonation: display name contains 'sydnee' but sender is email.sydneeinc.com
phishing urgent
Sydnee Inc Legal Aug 15 4:04 PM
Your access code
⚠ PHISHING: domain impersonation: display name contains 'sydnee' but sender is email.sydneeinc.com
phishing urgent
Sydnee Inc Legal Aug 15 4:00 PM
Veer 304E - test of the secure file links
⚠ PHISHING: domain impersonation: display name contains 'sydnee' but sender is email.sydneeinc.com
phishing urgent
Sydnee Inc Legal Aug 15 4:00 PM
Your access code
⚠ PHISHING: domain impersonation: display name contains 'sydnee' but sender is email.sydneeinc.com
phishing urgent
Amazon Payments Aug 15 12:52 PM
Action requise sur le compte Amazon Payments
Fake Amazon Payments suspension threat; credential harvesting attempt.
phishing urgent
Guest Relations at The Ritz-Carlton, Laguna Niguel Aug 15 10:49 AM
Kelvin, please complete the travel request form to customize your stay at The Ritz-Carlton, Laguna Niguel
Suspicious Ritz-Carlton email with obfuscation; potential credential theft attempt.
phishing urgent
Manus Team Aug 15 7:33 AM
ACTION REQUIRED: 7 days left to back up Kelvin Yan for future restoration
⚠ PHISHING: phishing subject pattern: 'ACTION REQUIRED' from external sender privaterelay.appleid.com
phishing urgent
Benjamin & Williams Aug 15 5:02 AM
Commercial Claim Discovery Documents Our file:D-8222 Debtor: VICTORIA ROPA ELEGANTE
Fake debt collection demand with 24h payment pressure; spoofed domain.
phishing urgent
Sydnee Agent (AI) Aug 15 4:15 AM
Sydnee nightly — PERFORMANCE audit 2026-08-15 — 0P0 2P1 13R
Sydnee Agent (AI): Sydnee nightly — PERFORMANCE audit 2026-08-15 — 0P0 2P1 13R
employee high
The Ritz-Carlton Reservations Aug 15 4:12 AM
Plan for your upcoming stay at The Ritz-Carlton, Laguna Niguel on Monday, August 17, 2026
Ritz-Carlton reservation confirmation for August 17 stay at Laguna Niguel.
personal
Tesla Aug 15 12:55 AM
Full Self-Driving (Supervised) Subscription Renewed
Tesla FSD subscription auto-renewed for Model Y, $107.29/month.
financial low
Sydnee.ai Legal Aug 14 9:22 PM
Jiao 移民案件最新进展说明（好消息，请放心）
⚠ PHISHING: domain impersonation: display name contains 'sydnee' but sender is email.sydnee.ai
phishing urgent
KuCoin Aug 14 6:38 PM
Dormancy Fee Deduction Notice
KuCoin dormancy fee deducted from account this month.
financial
Tommy Wang (Wang IP Law) Aug 14 6:30 PM
Re: I-485 Application (IOE0934359789 and IOE0934359788)
Tommy Wang (Wang IP Law): Re: I-485 Application (IOE0934359789 and IOE0934359788)
legal-ip high
Bank of America Aug 14 6:16 PM
We've sent your payment to SOUTHERN CALIFORNIA EDISON SCE as requested
Bank of America: We've sent your payment to SOUTHERN CALIFORNIA EDISON SCE as
financial high
Sydnee Agent (AI) Aug 14 5:42 PM
[Calibration Daily] 2026-08-15
Sydnee Agent (AI): [Calibration Daily] 2026-08-15
employee high
Sydnee Agent (AI) Aug 14 5:30 PM
Sydnee algo daily — dev $-2,239 · prod $+0 · 6d window
Sydnee Agent (AI): Sydnee algo daily — dev $-2,239 · prod $+0 · 6d window
employee high
Laguna Road Area Community Message Aug 14 2:39 PM
1 New School Flyer for Your Child
School flyer: Congressional App Challenge signup opportunity.
family
Anthony Patino in Teams Aug 14 2:34 PM
Anthony Patino sent a message
⚠ PHISHING: employee impersonation: display name matches 'anthony' but sender is teams.mail.microsoft
phishing urgent
TAnthony Patino Aug 14 1:34 PM
[Teams oneOnOne] (Teams DM)
Anthony Patino flagging ~$20k air shipment payment for approval.
employee
Amy Burghardt Aug 14 1:19 PM
RE: Meeting
Amy Burghardt: RE: Meeting
personal high
Mary Chmelka Aug 14 1:07 PM
Survey invite to Ameritas California Language Assistance Program Survey
Ameritas requesting language preference survey for insurance benefits.
vendor low
TAnthony Patino Aug 14 12:47 PM
[Teams oneOnOne] (Teams DM)
Anthony Patino requesting updated HDCVT statement.
employee
TAnthony Patino Aug 14 12:45 PM
[Teams oneOnOne] (Teams DM)
Teams DM acknowledgment from Anthony Patino.
employee
TAnthony Patino Aug 14 12:45 PM
[Teams oneOnOne] (Teams DM)
Anthony Patino confirms E-like assessment via Teams DM.
employee low
TAnthony Patino Aug 14 12:08 PM
[Teams oneOnOne] (Teams DM)
Anthony found something; not due for ~30 days.
employee
TAnthony Patino Aug 14 12:05 PM
[Teams oneOnOne] (Teams DM)
SAVLink payment $15,915 awaiting approval
financial high
TAnthony Patino Aug 14 11:59 AM
[Teams oneOnOne] (Teams DM)
Anthony Patino internal Teams message about communications or notes.
employee
TAnthony Patino Aug 14 11:56 AM
[Teams oneOnOne] (Teams DM)
Anthony Patino confirming he will set something up now.
employee
⚠ PHISHING / FRAUD SUSPECTED
This message may be impersonating a known contact or company. Do NOT click any links or open attachments.
Detection: Display name impersonates Intuit QuickBooks but sender domain is qw.intuit.com (suspicious subdomain); urgent tone offering $200 advance with obfuscated tracking IDs and shortened URLs to app.qw.intuit.com (not official Intuit domain); classic phishing pattern targeting password/credential capture; sent to loadkarma.com email during QB setup context makes this a credential-theft attempt.

You may have up to $200 available before payday

Intuit QuickBooks <[email protected]>
Wednesday May 27, 2026 · 10:32 AM PT · in [email protected]
AI verdict  phishing urgent · confidence: high · by haiku
“Fake Intuit/QuickBooks wage advance phishing targeting credential theft via suspicious domain.”
Reasoning: Display name impersonates Intuit QuickBooks but sender domain is qw.intuit.com (suspicious subdomain); urgent tone offering $200 advance with obfuscated tracking IDs and shortened URLs to app.qw.intuit.com (not official Intuit domain); classic phishing pattern targeting password/credential capture; sent to loadkarma.com email during QB setup context makes this a credential-theft attempt.
<a href="#">Ok les go</a> Access money when you need it ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ ͏ "Intuit Logo" <https://app.qw.intuit.com/e/er?s=1398831&lid=911&elqTrackId=4d518f67e598417f8a7590c70b8e9b93&elq=b1709ec66edb46ce93cada8e9cf35b02&elqaid=711&elqat=1&elqak=8AF5CEEA099CCA5EC7F74F69ADB2B531698143C932AAA488CE5EF1D39CB9A744C949> Sign in <https://app.qw.intuit.com/e/er?s=1398831&lid=910&elqTrackId=535d8169079245ceb200b34922f281dd&elq=b1709ec66edb46ce93cada8e9cf35b02&elqaid=711&elqat=1&elqak=8AF5E1DA6305ED904CBC3B18C9634AC7243B43C932AAA488CE5EF1D39CB9A744C949> "" <https://app.qw.intuit.com/e/er?s=1398831&lid=910&elqTrackId=84ae5e110dcb46be8e459602e2e7798e&elq=b1709ec66edb46ce93cada8e9cf35b02&elqaid=711&elqat=1&elqak=8AF5FF71D17B3228FB52A32F19D66089A80743C932AAA488CE5EF1D39CB9A744C949> Access up to $200 before your next payday Hi Kelvin, You may have access to up to $200 of your earned wages right now¹—no need to wait for payday. This is available through On-Demand Pay, powered by Clair. Bills, groceries, gas—life doesn’t pause. Get access to the money you’ve already earned when you need it. Access your pay <https://app.qw.intuit.com/e/er?s=1398831&lid=910&elqTrackId=0496bce52fec4aea915188bf6084e9d1&elq=b1709ec66edb46ce93cada8e9cf35b02&elqaid=711&elqat=1&elqak=8AF51DF7128683D716B19B6CDE52514F033743C932AAA488CE5EF1D39CB9A744C949> View on web <https://app.qw.intuit.com/e/es?s=1398831&e=1580102&elqTrackId=eb195bdd70254793b580e6f48a56a05e&elq=b1709ec66edb46ce93cada8e9cf35b02&elqaid=711&elqat=1&elqak=8AF535C6810DA8FE5AAB61D0A1AEAE453CFD43C932AAA488CE5EF1D39CB9A744C949> ELM ID: 9682-001 All Advances are originated by Pathward®, N.A. All Advances are subject to eligibility criteria and application review. Terms and conditions apply. 1. Instant Transfers typically occur in seconds, but may take up to 30 minutes. This message was sent to [email protected], as an Intuit customer, consistent with your email preferences. If you have chosen not to receive marketing messages, you will continue to receive business communications about your selected Intuit product(s), which may either affect your service or software, your account, or which may be legally required. Unsubscribe <https://app.qw.intuit.com/e/er?s=1398831&lid=130&elqTrackId=ffdb980be4224b9b9df9510034641588&tok=2gIAAAAbAQAEAAAADgUACDdHU1QyNE9PBgAGcJiF-EKLL2mApB8QHARzXScwdMrwGBF3Kg8AI1vWwE01Ac2pIlxY9KR2zzTjxcIyuJc0zaZHaJDh8lYC1UU6xB_TMuFD4b9zyqbgqd7jJQnTofesUxWkRJ_ydziYMN0jtXrBjgChmud9vKMrdoceuCHRI-pTPhY2lt3fQgI13R3UkbBrSFNVV7Hhe-71N1r25jiFn0XqI7dg4rqqX4DSnsTs-jM95TFTToIqOAO7c-DY &elq=b1709ec66edb46ce93cada8e9cf35b02&elqaid=711&elqat=1&elqak=8AF5A7ACC641FF018ECAEC11DB2CFD85950643C932AAA488CE5EF1D39CB9A744C949> | Security <https://app.qw.intuit.com/e/er?s=1398831&lid=6&elqTrackId=0934630dd66a4c8a9a179065a427890b&elq=b1709ec66edb46ce93cada8e9cf35b02&elqaid=711&elqat=1&elqak=8AF597C82B98DA754C5D02F7659304E66AD243C932AAA488CE5EF1D39CB9A744C949> | Privacy statement <https://app.qw.intuit.com/e/er?s=1398831&lid=5&elqTrackId=3594d9cb246b4ce1a543f705295f2535&elq=b1709ec66edb46ce93cada8e9cf35b02&elqaid=711&elqat=1&elqak=8AF57147306FB7D9EBBC11901E8C9C1C1D7D43C932AAA488CE5EF1D39CB9A744C949> © 2026 Intuit Inc., Trademarks. <https://app.qw.intuit.com/e/er?s=1398831&lid=4&elqTrackId=57f905454d574acb9eaaec38f3e8609e&elq=b1709ec66edb46ce93cada8e9cf35b02&elqaid=711&elqat=1&elqak=8AF510736FD1F2536DC7340F5AE84CA9547443C932AAA488CE5EF1D39CB9A744C949> 2800 E. Commerce Center Place, Tucson, AZ 85706 "Intuit brands" "Intuit brands"