Emails about an order, invoice or renewal you don't recognize

What these messages look like

The FTC has described this pattern several times. Its October 2022 alert describes texts and emails, using Best Buy's Geek Squad name, saying you've been or are about to be charged hundreds of dollars to renew a membership, and that you must call within 24 hours to dispute it. Its October 2024 alert calls these fake invoices for subscriptions you never bought. Its general guide to phishing lists an invoice you don't recognize among the common stories in fake emails. The FTC's tech-support guide adds McAfee and Norton to the names scammers borrow.

Fake order confirmations work the same way. Microsoft describes a message that "appears to be a routine confirmation for an order" you never placed, and says: "In order to cancel the fake order, you'll either have to click a link or call them on the telephone." If one comes as a recorded call or a voicemail instead, the FTC's advice for an illegal robocall is to "hang up and don't call back," and not to press a number.

A real company's address doesn't make the message safe. Scammers send invoices and money requests through real payment services, so the email can come from the service's own address. PayPal describes "an invoice or money request through PayPal containing an alarmist note", and its advice is: "Don't call any phone numbers in the invoice note or open suspicious URLs." Never call a number printed in an invoice you don't recognize.

What happens if you call

According to the FTC's alert on fake Geek Squad renewals, "If you call the number — which you should not do — the scammer might ask for remote access to your computer." Once connected, they may install spyware that steals your online banking details, or ask for your bank account information so they can "refund" you.

Then comes the refund trick. The FTC's tech-support guide describes it: the scammer says they refunded you too much and asks you to send back the difference by gift card, wire transfer, bank transfer, cryptocurrency or a payment app. The FTC's alert on fake Geek Squad renewals adds that some scammers "fake a transaction and make it look like they accidentally refunded you too much," so what you see on the screen can look real. There was never a real refund, so the money you "return" is your own.

How to check

1. Ask yourself one question. The FTC suggests asking: do I have an account with this company? If the answer is no, the FTC says it could be a phishing scam. Don't call the number or click the link to find out.
2. Look at your real statement. Check your card or bank statement, online or on paper, for the charge. For tech-support renewals, the FTC says that if you don't see the transaction, that tells you the message was a scam. If you do see a charge you didn't make, it says to report it to your credit card company or bank and ask them to reverse it. If the email says you will be charged, look again in a few days. And if you might have forgotten a real subscription, sign in to the company's site yourself to check.
3. Go to the company yourself. If you do have an account, sign in by typing the company's address or using its app, or call the number on your statement or card. Don't use the number in the message.
4. Look at the sender's address. The name your email program shows can be anything. Paste the address into our link checker to see the domain after the @ in plain words.

Why it works

Nobody likes an unexpected charge, and the instinct to stop it quickly is a good one. The message turns that good instinct against you: the quickest-looking route, the number in the email, leads straight to the people who sent it. The slower route, checking your statement first, is the one that works.

If you called or let them into your computer

Disconnect from the internet first. Then, if you opened your bank or card account while the caller was connected, or gave them account details, call that company now at the number on the back of your card or on your statement, and tell them what happened. Next, Microsoft's advice: "Uninstall any applications that scammers have asked you to install", such as AnyDesk, TeamViewer, ScreenConnect or Quick Assist, and delete any file they had you download. Security software often won't flag these, because they're real programs, as the U.S. Cybersecurity and Infrastructure Security Agency has noted. Then follow the FTC's steps from "What To Do if You Were Scammed": update your security software and run a scan, change your passwords and turn on two-step sign-in. For Windows computers, Microsoft adds: "If you have given scammers access to your device, consider resetting it." A reset can erase your photos and documents, so back up your important files first: Microsoft's guide to recovery options in Windows warns that "Some recovery options can result in data loss." If you're not sure how, ask someone you trust to help. If you sent money as a "refund," contact the company you used to send it and ask for it back. See what to do if you clicked, paid or gave information.

Related patterns

• Pop-ups and calls about a problem with your computerA warning that won't close, and a number to call.
• “Your account is locked” and other account warningsA problem with your account, and a link to sign in and fix it.
• Anyone asking you to pay with gift cardsBuy cards, scratch the back, read the numbers.