Got an invoice for a subscription you never bought? Don't call the number.
ScamChecker.online·Last verified May 2026·Active and widespread·5 min read
In a nutshell
An email or PDF invoice says you're being charged for a Geek Squad, Norton, McAfee, or PayPal subscription you don't remember buying, usually a few hundred dollars, "auto-renewing" now.
The charge isn't real. The invoice exists to make you call the "cancellation" or "refund" number on it.
The number reaches a fake call center. From there they push remote access to your device, a fake "refund" they say you must repay, or your bank details.
Don't call the number or open the attachment. If you already called or gave access, follow the steps below.
Our verdict
This is a scam. The invoice is bait, and the phone number is the trap. There's no real subscription and no real charge. Calling connects you to scammers who try to take over your device or your bank account, often by faking a "refund" they then trick you into repaying.2
Advertisement728×90 · Replace with AdSense unit
Does this sound familiar?
An email landed saying your antivirus or tech-support plan is about to auto-renew for $300 to $500, with a PDF invoice attached and a phone number to call if you "didn't authorize this" or want a refund. You don't remember subscribing, and the charge is big enough to make you want to stop it fast. So you reach for the number. That reflex is exactly what the scam is built on.
Below are reconstructed examples of how these invoices look, recreated to show the pattern. They impersonate real companies like Best Buy's Geek Squad, Norton, McAfee, and PayPal. Those companies do not send these. (Illustrations, not real invoices. Brand names are impersonated; numbers and amounts are fictional.)
@
Geek Squad Billing
support@geeksquad-renewal.info
Email · Today 7:41 AM
Your Geek Squad Protection plan auto-renews today for $399.99 (3 years). This charge is non-refundable after 24 hours. To cancel or dispute, call our billing team:
+1 (888) 555-0143
The sender domain isn't Best Buy's. The deadline and "non-refundable" pressure you to call before you think.
@
Invoice Service
noreply@invoicing-app.com
Email · Today 12:09 PM
Invoice #NRT-56351 - Norton 360 Deluxe, 3-Year Renewal: $349.99. Payment processed. Questions or refund? Contact us at
+1 (888) 555-0190
Thank you for your business.
Some are sent through real invoicing services to beat spam filters. The brand is impersonated; the callback number is the scam.2
@
PayPal
service@paypal.com
Email · Today 4:23 PM
You sent a payment of $499.99 USD to "Crypto Exchange Ltd." If you did not authorize this, call us immediately to dispute:
+1 (888) 555-0177
The PayPal variant can arrive as a real invoice from PayPal's own system. PayPal is the impersonated brand; the number leads to scammers, not PayPal.2
The brand and the amount change, the invoice may even arrive through a genuine billing service, but it always ends the same way: a phone number that connects you to the scammer, not the company.
How it works
Unlike a link-based phishing scam, this one wants you on the phone. The invoice is just the excuse to dial. (The screens below are illustrations of how the steps look.)
1
The invoice you didn't expect
An email or attached PDF says you've been billed, or are about to be, for a subscription you don't recall: antivirus, tech support, a large PayPal payment. The amount is high, the window is short, and the only way to "fix" it is the phone number on the invoice.
G
Geek Squad
INVOICE #GS-78412
PlanTotal Protection, 3yr
StatusAuto-renewing today
Amount due$399.99
To cancel or get a refund, call
+1 (888) 555-0143
"Non-refundable after 24 hours"
There's no real charge. The whole document exists to get you to dial that number.
2
The fake call center
You call to cancel or get your money back. A friendly "agent" answers, confirms your "account," and offers to process the cancellation or refund. To do it, they say they need to connect to your computer, or have you log in to your bank, to "verify" or "send the refund."
Call connected
"Billing Support"
+1 (888) 555-0143
● 04:12
"To process your refund, I'll just need remote access to your device…"
A real company never needs remote access or your bank login to cancel a charge.
3
The "oops, we refunded too much" trick
With remote access, they open a fake bank page and make it look like they refunded you far too much, say $5,000 instead of $500. Then they panic: they'll "lose their job" unless you send the extra back. You're sending your own money to the scammer.
🖥 Remote session active
Your Bank · Recent activity
Refund: Geek Squad+$5,000.00
Intended refund$500.00
"I typed an extra zero!" "Please send back the $4,500 difference or I'll lose my job."
The "overpayment" is faked on a screen they control. Repaying it sends real money to them.2
4
What they actually take
Depending on the version, they walk away with the "overpayment" you wired or sent in gift cards, your bank login and card details, or quiet control of your device through the software you installed. Some come back weeks later for more.
How the loss adds up…
↓
"Overpayment" repaid−$4,500
↓
Gift cards "to fix it"−$600
↓
Unauthorized transfer−$2,000
And the quiet damage
Remote-access software can leave a back door. Bank logins and card details get reused or sold. Treat your device and accounts as compromised.
The fake charge was never the cost. Access and repayment are.
Remember
An invoice for something you never bought is the bait, not a bill.
Never call the number on a suspicious invoice. It's the scammer's line.
No real company needs remote access to cancel a charge.
A "refund" you must partly send back is always a scam.
Red flags to catch it early
None of these alone is proof. Several together means delete it.
A bill for something you never subscribed to
Antivirus, a "protection plan," or a large payment you don't recognize. The unfamiliarity is meant to make you call in a hurry.
A phone number is the only way to "fix" it
The invoice pushes you to call, not to log in to a real account. The number is the heart of the scam.
"To cancel or dispute this charge, call +1 (888)…"
A sender address that isn't the real company
Odd domains like geeksquad-renewal.info, or an invoice from a generic billing service rather than the brand itself.
They ask to remote into your computer
Any request to install software like AnyDesk or TeamViewer, or to "share your screen," to process a refund. No legitimate refund needs this.
A "refund" that's somehow too much
They claim they accidentally sent you thousands too much and beg you to return the difference. The overpayment is fake; your repayment is real.
Repayment in gift cards, crypto, or wire
A genuine company would simply reverse a real charge. Gift cards or a wire to "give the money back" is a guaranteed scam.
Worried you might actually have a subscription?
Easy to check, without touching anything in the email:
Don't call the number or open the PDF. Treat the whole message as hostile.
Check your real accounts directly. Log in to the company's actual site or app, or look at your card and bank statements for any real charge.
If you want to contact the company, use the phone number or support page from its official website, never the one on the invoice.
No charge on your statement means no subscription. The invoice is fake, and you can delete it.
Already called, paid, or given remote access?
If you're in this right now
Disconnect, secure your device and bank, then report
Work through whatever applies. With remote access or money sent, act fast.
1
You only got the invoice, or called and hung upLow risk. Don't call back, don't open the attachment. Delete it and report it (below). You're fine.
2
You let them remote into your deviceDisconnect from the internet. Uninstall any remote-access software they had you add (AnyDesk, TeamViewer, etc.). Run a security scan, and if unsure, have the device checked by a trusted technician. Change passwords from a different, clean device.
3
You sent money or "returned an overpayment"Call your bank now. Report it as fraud and ask whether the wire or transfer can be recalled. Gift cards: contact the card issuer immediately, some can freeze remaining balances. Save the card numbers and receipts.
4
You shared bank or card detailsTell your bank to watch for or block fraud and reissue cards. Change your online banking password and turn on two-factor authentication. Watch statements closely for weeks.
5
Report itFile with the authority for your country below. For US PayPal-branded versions you can also forward the email to phishing@paypal.com. Reporting helps shut down the call centers.
6
Ignore anyone who later offers to "get your money back"People who've lost money are quickly targeted by a follow-up money recovery scam, a second fraud charging an upfront fee to recover funds. No legitimate service or agency works that way.
If you gave remote access or bank details, your bank's fraud line is the first call. Reporting to the FTC and FBI helps track the call centers behind these invoices.
Wherever you are, don't use the number on the invoice. Contact the company through its official website, and your bank on a number you trust.
How big is this problem?
Fake invoices ride on trusted brand names, and the brands they impersonate are some of the most recognized in the country, which is exactly why they work.
#1
Best Buy / Geek Squad was the most-impersonated brand in FTC reports for 20231
~52,000
Reports of scammers impersonating Best Buy / Geek Squad in 20231
Top 3
PayPal was the third most-impersonated brand, with about 10,000 reports1
$60M
Reported lost to Microsoft impersonation, the costliest brand impersonation by losses1
The FTC's data on the most-impersonated companies puts Best Buy and its Geek Squad brand at the top for 2023, with about 52,000 reports, followed by Amazon and then PayPal at roughly 10,000.1 The fake-invoice scam is one of the main ways the Geek Squad name gets abused: a renewal notice with a callback number that leads to a fake support line.3
Security researchers have tracked the same template mutating across brands and delivery methods. The invoices have impersonated Norton, McAfee, and a fictitious "Bitcoin Exchange," and have been sent through legitimate invoicing services like QuickBooks and PayPal so they slip past spam filters and look authentic.2 Whatever the brand, the destination is a phone number, and the call leads to a remote-access takeover, a faked "overpayment" you're pressured to repay, or a request for your bank details.2
The reason it keeps working is simple: a surprise charge for hundreds of dollars makes people want to act immediately, and a phone number feels like the safe, human way to sort it out. That instinct is the vulnerability. The companies named are being impersonated, and their real support lines never appear on a scam invoice.
Intego Mac Security Blog research on fake-invoice ("Geek Squad," Norton, McAfee, PayPal, "Bitcoin Exchange") scams and their abuse of legitimate invoicing services. The callback-number mechanic, remote-access and fake-refund tactics, and invoices sent via QuickBooks/PayPal to evade filters. Cited as documented security research.
Consumer reporting and Better Business Bureau / FTC consumer guidance on the Geek Squad renewal-invoice scam. The renewal-notice-plus-callback-number pattern and the fake customer-service line.
Researched and maintained by ScamChecker.online
We document recurring online scam patterns using primary sources: government agencies, law enforcement, and security researchers. Best Buy, Geek Squad, Norton, McAfee, and PayPal are legitimate companies being impersonated, not the source of these invoices. Ads on this page do not influence our reporting. Read about how we research or who we are.
Last verified: May 2026·Reviewed against current FTC guidance and security research