Scam pattern
Geek Squad / Norton renewal-invoice scam
“Your subscription auto-renewed for $399 — call to cancel”
An email shows a renewal invoice for Geek Squad, Norton, McAfee, or similar, with a number to “cancel.” The number reaches scammers who request remote access and an overpayment “refund” that drains your account.
How it’s usually worded
- “Geek Squad: Your annual protection auto-renewed for $399.99. To cancel call 1-8XX-XXX-XXXX.”
- “Norton LifeLock renewal confirmed. Didn't authorize? Call our billing team.”
- “We refunded too much — please send back the difference.”
Red-flag signals
- Invoice for something you don't have
Panic over a charge makes you call the number.
- “Call to cancel/refund”
The phone number is the trap — it's the scammer, not the company.
- Remote-access for a “refund”
They watch you log in and stage a fake overpayment.
- Overpayment trick
They “accidentally” refund $4,000 and demand you wire the difference back.
What to do
Don't call numbers in the email. Check for real charges by logging into your bank / the vendor directly. Never install remote-access tools for a refund.
Got one like this? Check it now.
Paste your version below for an instant RED / YELLOW / GREEN verdict.
FAQ
The invoice has a real-looking logo — is it legit?
Logos are trivial to copy. Verify only via the vendor's official site or your bank statement, never the email's phone number.
Why do they want to “refund” me?
To get remote access and trick you into thinking they overpaid, so you send your own money back to them.