Apparently this is still going on and needs to be a way to keep them from being spoofed. On the last email it was like this.
Pretending to be Geek Squad using a known IP (Denver, CO) that is not associated with them to get you to open a pdf file with an auto loader trojan. Intuit E-Commerce Service ([email address removed]) is what it is spoofing to show this email since that is a listed ok for most email systems but not the actual originating email. Using a padded email address from [email address removed] using a SMTP at IP: 10.217.147.138 (Los Angeles, CA)
