I don't know the email addresses for this service but whois.com indicates Sage in Georgia owns it.  Since that is the North American Sage head office, I would suspect it is real but the fact there is no customer-facing website at that address makes it look real phishy.  it should at least redirect to a proper Sage landing page.

If the client didn't ask to supply a new code, I would wonder why the website is asking for it.

Hi Jay Noden, thanks for reaching out and being vigilant!

I'm not finding a reference to the email  in my resources. Our domain would end with sage.com typically, so I'd suggest forwarding the email to our team at [email protected]. They'll be equipped to investigate whether it's phishing or fraud related.

Warm Regards,
Erzsi

It is very strange indeed. This client has been having non-stop issues with the Remote Data Access feature and tells me today that this is not the first email like this received. They seem to think that it has something to do with the RDA feature so have been ignoring the email messages. It does not make sense to me that anything in RDA would trigger an email from that domain and, as you noted, why can't a search of that domain lead somewhere valid.

Thank you. I have advised the client to keep the original email as well as forwarding a copy to the email address you noted.

Just because the reply address indicates sagedirectdebits.com and that appears to be a Sage-owned domain according to whois.com for over three years, that doesn't mean a link in the email isn't going to lead to a phishing website that doesn't belong to Sage.  This can be seen by hovering a mouse over the links in Outlook without clicking.

Apparently a company has been masquerading as one of the Canadian banks in the US, getting info from the bank's customers and reselling it (disclaimer: this is just what I read, I don't know any details).  I received an email today from "Canada Post" with a Swiss top level domain reply address.  I've also seen emails spoofing Intuit branding.  So I wouldn't doubt Sage branding is being used for phishing too.

I have this come up with my account too.  I am not sure if it is the Cloud Accounting I set up on the remote feature or Stripe and/or access to client accounts whom want access to their books.  

Hi Jay Noden / CatrinaM, 

Update that I looked into Richard S. Ridings's riding note above and reported it to our web team. Seems that domain is owned by us. We should be able to have it redirect to sage.com so that it's more clear who it belongs to. Thanks for reporting this!

Warm Regards, 
Erzsi

Update regarding the concern over emails from [email protected] (the domain is owned by Sage). The sender email address has been changed to [email protected].