Defense Brief · Issue #006

The Fake $499 Renewal Invoice: Why Calling to Cancel Is the Trap

An email says you were charged $499 for a Geek Squad or Norton renewal you never bought. Here is how the fake-invoice scam works, the three red flags, and what to do if you already called.

November 3, 2026 · Red Flag Weekly

You open your email and your stomach drops: "Thank you for your purchase. Your Geek Squad Total Protection plan has been renewed. Amount charged: $499.99. If you did not authorize this charge, call our billing department within 24 hours."

You don't remember buying that. Your first instinct is to call and cancel. That phone call is the trap.

Scammers send fake invoices that use names people recognize, like Geek Squad, Norton or McAfee. The goal is not to charge you $499. The goal is to scare you into calling them. FTC

Know the Signs

Three warning signs of a fake renewal invoice

1
A charge you never made, with a deadline
A large renewal or purchase you don't recognize, plus pressure to act within hours. The panic is the point.
2
A phone number to "cancel" or get a refund
Real companies don't need you to call a number in a surprise email to stop a charge. The number goes straight to the scammer. FTC
3
A request for remote access, gift cards or bank logins
The "agent" asks you to install software so they can "process your refund," or to log in to your bank. Legitimate companies won't do this. FTC

How the scam works

Once you call, a friendly "billing agent" offers to cancel the charge. They ask you to install a program so they can reach your computer. Then they show you a screen that says they "accidentally" refunded you far too much — say $4,999 instead of $499.

Now they beg you to send the "extra" back by wire transfer, gift cards, cryptocurrency or cash. There was never any refund. The money they ask you to send is yours.

How to check a charge safely

Don't call the number in the email and don't reply.
Check your bank or card app yourself. If the charge isn't there, there's no charge. Always verify the purchase in your bank app.
Log in to the real company account by typing its website yourself, if you actually have a subscription.
Never let a caller onto your computer. Real support won't contact you out of the blue to ask for remote access. FTC

What to do if you get the email

Your defense plan

Don't call, click or reply.
Every response tells the scammer you're a target.
Verify in your bank app.
Look for the charge yourself. No charge means no problem.
Report it to the FTC.
Tell the FTC at ReportFraud.ftc.gov.
Delete the email.
Once reported, remove it so no one in your home calls the number by accident.

Already called or let them in?

Please don't be hard on yourself. These emails are built to cause panic. What matters now is acting quickly.

Hang up and disconnect. Turn off your internet connection and uninstall any program the caller had you install. Run a security scan with software you trust. FTC
Call your bank or card company using the number on the back of your card. Tell them a scammer may have accessed your accounts.
Change your passwords for email, banking and any account you used during the call — from a different, safe device if you can.
If you paid with a gift card, contact the company that issued it right away and tell them it was used in a scam. Keep the card and receipt. FTC
If you shared personal information, go to IdentityTheft.gov for a step-by-step recovery plan.
Report it at ReportFraud.ftc.gov.

Share this to protect someone you love. Parents and grandparents are frequent targets of fake renewal emails — a quick heads-up can save them thousands.