Fake Renewal Invoice Emails: Geek Squad, Norton, McAfee and PayPal Scams Explained

Short answer: an email saying you've been charged a few hundred dollars for a Geek Squad, Norton, McAfee or similar renewal you don't remember, with a phone number to call "if you didn't authorise this", is a scam. The charge usually doesn't exist. The scam starts when you call the number. Don't call it. Check your bank statement and your real accounts instead.

How the fake invoice scam works

1. You get an email or PDF invoice for an "annual protection plan" or antivirus renewal, often $200 to $500, sometimes sent through a real invoicing service so it passes spam filters.
2. Worried, you call the number to cancel. A friendly "agent" offers a refund.
3. They ask you to install a remote access app such as AnyDesk, TeamViewer or UltraViewer, and to log in to your online banking "to receive the refund".
4. They fake a typing mistake so it looks like you were refunded far too much, then beg you to send the difference back by bank transfer, gift cards, crypto or cash.

In reality nothing was refunded: they moved your own money between your accounts, or edited the page you were looking at.

Signs the invoice email is fake

• You never bought the product, or you don't have an account with that company.
• It comes from a Gmail, Outlook or random address, not the company's own domain.
• The main thing it wants is for you to call a number, not log in to your account.
• Geek Squad, Norton, McAfee and PayPal branding appear in the same style of email, or several brands in one message.
• For PayPal: a real PayPal invoice can be sent by anyone with a PayPal account, so scammers use PayPal itself to send fake bills. A note on the invoice telling you to call a number is the giveaway.

What to do

1. Don't call the number, reply or open attachments.
2. Check your bank or card statement. If there is no charge, there is nothing to cancel.
3. Check your real accounts by typing the company's website yourself (bestbuy.com, norton.com, paypal.com). For a PayPal invoice you don't recognise, don't pay it; report it inside PayPal.
4. Report it: to the FTC at reportfraud.ftc.gov, and forward PayPal-themed emails to phishing@paypal.com.

Already called, or let them into your computer?

1. Disconnect the computer from the internet and uninstall the remote access app.
2. Call your bank using the number on your card. Tell them someone had access to your online banking, and ask them to stop any transfers.
3. Change your passwords from a different device, starting with email and banking, and turn on two-step verification.
4. Have the computer checked or reset before using it for banking again.
5. If you sent money or gift cards, read what to do if you sent money to a scammer.

Seeing a real charge you don't recognise? See what to do about an unknown charge on your card.