Fake Xero login pages: how to spot the real one

Xero’s real sign-in page is at login.xero.com. Nothing else is. A fake billing email is plausible this month because Xero’s US prices genuinely change on 1 October 2026, and that change reaches subscribers on their invoices — Xero’s pricing update notice, retrieved 9 September 2026. Check any billing claim inside your account, never through the email’s link.

Why you’re getting Xero emails right now

Xero does send real billing mail, which is exactly what makes a fake one work.

What Xero actually sends you

Xero runs a public security noticeboard for known scams and asks users to forward suspected phishing to a reporting address it publishes — Xero’s security page, retrieved 9 September 2026.

Why your inbox is busy this month

A genuine US pricing change is landing, so billing-themed mail from Xero is arriving legitimately. If your question is the broader one, whether Xero can be trusted at all, that sits with what Xero does with your data.

The two checks everyone gives you, and where each fails

Both are repeated on nearly every page about this, and both have documented failure modes.

Checking the sender’s domain

The advice is to confirm the mail came from a xero.com address. In October 2025, Cofense documented a campaign using a Xero sending address while impersonating other brands entirely. A real-looking sender is not proof.

Relying on your MFA code

Partly effective, not decisive. CISA states FIDO/WebAuthn sign-in blocks the attempt on a fake site, and calls it the only widely available phishing-resistant method, retrieved 9 September 2026. Xero’s multi-factor authentication uses codes or push approval, per its MFA page retrieved 9 September 2026, and CISA classes neither as phishing-resistant.

⚠️ This Costs You: If your password reaches an attacker, the second factor is the only thing left between them and your ledger — and none of Xero’s supported methods is in the category CISA calls phishing-resistant, retrieved 9 September 2026.

The address bar test, and two places worth memorising

One check holds when the others fail: read the address bar on the page asking for your password.

Where Xero’s real sign-in page lives

The sign-in page sits at login.xero.com, per the login link on Xero’s own security page, retrieved 9 September 2026. Type it or bookmark it. We have deliberately not linked it: a page telling you not to reach your login through someone else’s link should not hand you one.

Where to check a billing claim instead

Your subscription details sit at my.xero.com, the destination Xero’s own update notice points subscribers to, retrieved 9 September 2026.

✅ Do This: Bookmark both addresses now, while you are not under time pressure. The habit only works if the bookmark exists first.

A real Xero billing change is happening, and that is the problem

The most convincing lure this month is true.

What is actually changing

Xero’s US subscription prices rise on 1 October 2026, and the multi-organization discount begins phasing out the same day — Xero’s pricing update notice, retrieved 9 September 2026. Plan-by-plan figures belong with our record of the increase, and full costs with the pricing guide.

How a genuine change reaches you

On your invoice. The notice states the change shows on invoices dated from 1 October 2026 onward, which means a real price change needs nothing from you. An email demanding payment details to keep your plan asks for something the published process does not require.

🗓️ Pricing verified 9 September 2026. Software pricing changes frequently — confirm on the vendor’s site before acting.

If you already entered your details

Do this now, in order, and read the rest later.

The first three steps

1. Open a new tab, type the sign-in address yourself, and change your password there.
2. Check whether the account shows any user, connection or bank feed you do not recognise.
3. Forward the message to the reporting address on Xero’s security page, retrieved 9 September 2026.

Who to tell

Tell Xero support the account may be compromised. We could not verify Xero’s published procedure for ending active sessions, so let them handle it rather than following steps from elsewhere. If your login reaches client organisations, assume every one is exposed. Being locked out by two-step authentication is a different problem with a different fix. A compromise of accounting records may carry reporting obligations, and your accountant should advise on those.

What would make these checks unnecessary

One change takes the copied login page out of play.

Why a passkey defeats a copied page

A passkey is bound to the real site’s address, so a copy of the page has nothing to collect. CISA names FIDO/WebAuthn as the only widely available method with that property, retrieved 9 September 2026.

What we could not verify

Xero Central publishes passkey login instructions, and Xero maintains a security noticeboard. We could not retrieve either page in full, so we make no claim about current passkey availability, rollout scope, or which scams the noticeboard lists today.

🧾 Not Tested: We hold no Xero subscription and captured no logged-in screen. We also visited no phishing page, by choice — nothing here is described from an attacker’s infrastructure. Three public Xero pages, one CISA page and one CISA fact sheet were retrieved on 9 September 2026. Xero Central’s passkey article and Xero’s security noticeboard could not be retrieved in full, and no claim rests on their contents.

Frequently asked questions

The habit that replaces the checklist

A claim about your account gets checked inside your account, reached by an address you typed yourself. Not the link, not the sender, not the code you were sent. If the claim is real, it is waiting when you sign in. If not, you lost nothing.