Fake Geek Squad, Norton and McAfee Renewal Emails

A fake Geek Squad renewal email looks like a receipt. Your Geek Squad, Norton or McAfee subscription has “auto-renewed,” and you’ve been charged hundreds of dollars. If you didn’t authorize it, the message says, call this number within 24 hours for a refund. That number is the scam.

The FTC says tech support scammers use the names of well-known companies like Geek Squad, McAfee and Norton to get your attention. It is one of the ways tech support scams start. Red Flag Briefing is not affiliated with Best Buy, Geek Squad, Norton or McAfee.

What does a fake renewal email look like?

According to the FTC, you might get an email or text saying you were charged hundreds of dollars for a tech support subscription renewal, and that you must call a phone number within 24 hours if you want to dispute the charge.

EXAMPLE — SCAM

Today 9:41 AM●●● ▮

From: Billing Team <renewals@protect-billing.example.com>

Subject: Your subscription has been renewed — Invoice #58-0193

Thank you for renewing your Total Security Plan. Your account has been charged $399.99 for 3 years of protection.

If you did not authorize this renewal, call our refund desk within 24 hours at (888) 555-0137 to cancel and receive a full refund.

The details change, but the pattern doesn’t: a charge you don’t recognize, a short deadline and a phone number to call. Like other phishing emails, the message is built to make you react before you check.

Why do scammers want you to call them?

Because the call is where they take control. The FTC says that if you call, the scammers ask for remote access to your computer. They may also send you to a spoofed website that looks real and tell you to enter your bank or credit card information to “process the refund.”

Then comes the twist: they claim they refunded too much by mistake and insist you pay back the difference, with gift cards, a wire transfer, a bank transfer, cryptocurrency or a payment app. There was no refund. The money you “pay back” is the scam.

How can you check whether you were really charged?

Look at your own records, not the email:

1. Check your bank or card statement. The FTC says that if you don’t see a transaction for a tech support subscription, that tells you the message was a scam. Ignore it and delete it.
2. Contact the company directly. Use a phone number or website you know is real. The FTC says not to use the number included in the message.
3. Don’t search for the number. Scammers can put fake help-line numbers in search results. See fake customer service numbers in search results.

What happens if you let them into your computer?

Once they have remote access, they can see your screen, open your accounts and install software. In some cases the call turns into a much bigger con, with a fake “bank” warning you that hackers are in your accounts. That is the Phantom Hacker scam.

If you gave remote access, the FTC’s advice is to update your computer’s security software, run a scan and delete anything it flags, then change your passwords.

What should you do if you already called?

• If you paid or shared card or bank details: call your card company or bank, report an unauthorized charge, and ask them to reverse it. Our first-hour checklist after a scam covers each payment method.
• If you gave your username and password: the FTC says to change your password right away, and on any other account that uses the same one.
• Report it to the FTC at ReportFraud.ftc.gov. You can also forward the email to the Anti-Phishing Working Group; see how to report a phishing email.

Expect follow-up calls offering to get your money back. Those are recovery scams.