Fake tech support emails: how to spot the bogus renewal invoice
Quick answer
An email or text saying you were charged hundreds of dollars to renew a tech support plan, with a number to call within 24 hours, is a scam. Don't call it. Check your bank or card statement: if there's no charge, delete the message.
- Comes by
- Email, Text, Phone call
- Pretends to be
- Geek Squad, McAfee and Norton
- Last updated
How it works
Scammers send notices about an automatic renewal for a tech support subscription. The FTC says they borrow the names of well-known companies like Geek Squad, McAfee and Norton. The message claims you were charged hundreds of dollars and that you must call a phone number within 24 hours to dispute it.
If you call, the person asks for remote access to your computer. They then send you to a spoofed website that looks real and ask for your bank or card details to process a "refund". Next they claim they refunded too much and insist you pay the difference back by gift card, wire transfer, bank transfer, cryptocurrency or a payment app.
What they want is money, your banking logins and control of your computer. Some versions go further: the fake technician says your accounts were hacked, then hands you to a "government agent" who tells you to move your money to protect it. No real agency does that.
Red flags
- A charge for a tech support plan you never bought
- A deadline of 24 hours to call a number in the message
- A request for remote access to your computer
- A "refund" that goes wrong, followed by a demand to pay money back
- Payment by gift card, wire, crypto or payment app
- A pop-up that tells you to call a number: real security warnings never do
Example message
Your annual protection plan has renewed and $[amount] was charged to your account. If you did not authorize this, call [phone number] within 24 hours to cancel and get a full refund. Invoice attached.
What to do
- 1
Don't call the number or open the attachment
Delete the message. If you think it might be real, contact the company using a phone number you know is real, not the one in the message.
- 2
Check your bank or card statement
If there's no charge for a tech support plan, the message was a scam. If there is one, tell your bank or card company it was unauthorized and ask them to reverse it.
- 3
If you gave someone remote access, disconnect
Turn off the computer's internet connection, uninstall any remote access program they had you install, update your security software and run a scan.
- 4
If you shared a password, change it now
Change it on that account and anywhere you reuse it, and turn on two-step verification. If you gave out bank details, call your bank on the number on your card.
- 5
If you paid, act fast
Contact the payment provider or bank right away and say it was fraud. Our guide on what to do after a data breach covers freezing credit and watching for identity theft.
Report it
Check if your details are exposed with Serus
Scammers find your number and address on data brokers and people-search sites. Serus removes them.
Why you got it
Scammers send these in bulk, but the ones that use your real name or email are more believable. Names, emails and phone numbers are sold by data brokers, listed on people-search sites and leaked in breaches. Serus finds the data brokers that list you and removes you from them, and alerts you when your email shows up in a breach, so fewer scammers can reach you.
Frequently asked
Is the Geek Squad renewal email real?
Scammers use the Geek Squad name, as well as McAfee and Norton, on fake renewal notices. If you're unsure, contact the company with a number you know is real and check your statement for a charge.
What if the invoice shows a charge I don't recognize?
Check your card or bank account. If you see an unauthorized charge for a tech support subscription, tell your bank or card company and ask them to reverse it.
Will a real tech company contact me about a problem with my computer?
The FTC says legitimate tech companies won't contact you by phone, email or text to say there's a problem with your computer.
I let them into my computer. What now?
Disconnect from the internet, remove the remote access software, update your security software and run a scan, then change passwords and call your bank.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
