That "Geek Squad" or "Norton" Renewal Invoice Is a Scam — and So Is the "Refund"

You open your email and there it is: a tidy-looking receipt saying your Geek Squad, Norton, or McAfee subscription has automatically renewed for $299, $399, or some other alarming number — and it will hit your card in the next day or two unless you call the "billing department" to cancel. Your stomach drops. You never signed up for that. So you reach for the phone.

Stop there. That email is a fake invoice, and the phone number on it is the whole point of the scam. Almost certainly no charge has been made and no money has left your account — the receipt is bait, designed to scare you into calling a "support" line that is run by criminals. This is one of the most common scams hitting Southern California inboxes right now, and it targets exactly the people who are careful with their money. Here is how it really works, the one rule that beats it, and what to do if you already called.

What the email actually is

It is not a bill. It is a plain email dressed up to look like a billing confirmation, a renewal receipt, or an order notice — complete with a company logo, an order number, a total, and often a PDF "invoice" attached. The brand changes but the script does not: Geek Squad (Best Buy), Norton, McAfee, PayPal, and sometimes "Amazon" or an antivirus you've never heard of. The message always claims you've been charged, or are about to be, for a subscription you don't remember buying.

And it always, always includes a phone number "to cancel, dispute the charge, or request a refund." That number is the trap. A real receipt from a real company doesn't exist to get you to call a hotline — it exists to confirm a purchase you actually made. When the entire message is engineered to make you dial a number in a panic, the number is the product being sold.

Why it works: the fear is the money, not a virus

This is a close cousin of the fake "your computer is infected" pop-up scam, but it flips the hook. The pop-up scares you about your computer; this one scares you about your wallet. "You've just been charged hundreds of dollars for something you didn't buy" is a powerful jolt — it makes people call immediately, before they've had a moment to think, because they want to stop the charge and get their money back.

That urgency is the scammer's best tool. Once you're on the phone, a calm, friendly "agent" takes over. They'll offer to cancel the subscription and refund you — and to do that, they'll say, they just need your card number, or they need to "connect to your computer" to process the refund. Either way, the second you hand over card details or let them install a remote-access program (AnyDesk, TeamViewer, and the like), the real crime begins.

The refund trick — where the real damage happens

The nastiest version of this scam isn't the fake charge at all. It's the fake refund. Here's the move, and it's worth knowing because it has cleaned out people's life savings. The "agent" gets you to let them onto your computer to "process your refund," then has you log in to your online banking so they can "send the money back." While you watch, they appear to deposit your refund — but they "accidentally" type an extra zero, so instead of $400 it looks like they sent you $4,000.

Then comes the panic: "Oh no, I'm going to lose my job, I sent you too much — you have to send the extra $3,600 back or I'm in serious trouble." They pressure you to return the difference fast, usually in a way that can't be reversed: gift cards read aloud over the phone, a wire transfer, or cryptocurrency. But there was never any refund. The number on your screen was faked — they may have quietly moved money between your own accounts to make the balance look right. The money you "send back" is your own, and once it's gone as gift cards or crypto, it's gone. The U.S. Federal Trade Commission is blunt about this pattern: if anyone says they overpaid you by accident and asks you to return the difference with gift cards, a wire, or crypto, it is always a scam.

The one rule that beats the whole thing

Never call the number in the email, and never click its links or open its attachment. That single habit defeats this scam completely, because the entire con depends on you using their number instead of checking for yourself.

Instead, do the one thing the email is built to stop you from doing: look at your actual money. Open your bank or credit-card account the normal way — type the address yourself or use your own saved bookmark or the bank's app — and check your recent transactions. If the charge isn't there, the email is fake and there is nothing to cancel. If you genuinely have a Norton, McAfee, or Best Buy account and want to be sure, log in to that account directly (again, by typing the address yourself) and check your subscriptions there. If you still want to call the company, look their number up on their real website or the back of your card — never the one printed in the email.

How to tell a fake invoice at a glance

A few tells give these away almost every time. It doesn't use your name — the greeting is generic ("Dear Customer," "Dear User") because it was blasted to thousands of addresses at once. It pushes urgency: the charge hits "within 24 hours," the offer "expires today," you must "act now." The amount is deliberately alarming — a few hundred dollars, big enough to make you react. And there's that phone number front and center, sometimes as the only way to "resolve" it.

Look closer and more cracks show: the sender's email address is a jumble or a look-alike domain rather than the company's real one, there are odd spelling and grammar slips, the logo is slightly off, and the "invoice" is a PDF or image attachment (which also helps it slip past spam filters). Any one of these is a warning; together they're a neon sign. When in doubt, remember the core fact — a real company confirms a purchase you made; it doesn't email you a scary bill for something you didn't buy and beg you to call.

What to do with one of these emails

Don't call, don't reply, and don't click any link or open the attachment. Replying or calling just confirms your address and phone number are live and invites more. Verify against your real bank statement and account as above; when the charge isn't there, you can simply delete the email.

If you want to do more than delete it, report it — it's quick and it helps. Norton asks you to forward scam emails to spam@norton.com and McAfee to scam@mcafee.com; you can also report the scam to the FTC at ReportFraud.ftc.gov, and mark the message as phishing or junk in your email app so your provider learns to filter the next one. Then block the sender. That's it — no software to buy, no "protection plan" to sign up for.

If you already called, gave them access, or sent money

Don't freeze — act, because moving fast is what limits the damage. If you let them onto your computer, disconnect it from the internet, then uninstall any remote-access program they had you add (AnyDesk, TeamViewer, UltraViewer, LogMeIn and the like) and run a full scan with your built-in security (Windows Security / Microsoft Defender). From a different device — your phone or another computer, not the one they touched — change the passwords for your email and banking, and turn on two-factor authentication where you can.

If any money or card details were involved, call your bank or card issuer right now using the number on the back of your card, tell them it was a scam, and ask them to watch for or reverse the transactions. If you paid with gift cards, contact the card company that issued them (Apple, Google Play, Amazon, Target) as soon as possible and ask them to freeze the funds — sometimes, if you move quickly, the money can still be stopped. Report the whole thing at ReportFraud.ftc.gov. None of this is anything to be embarrassed about; these scripts are built by professionals to override careful people's judgment, and the sooner you flag it, the more can be undone.

How we can help

If one of these landed in your inbox — or a parent's — and you're just not sure whether it's real, that uncertainty is the whole reason the scam works, and it's a fine reason to ask. We help people across Southern California and the Coachella Valley, from the desert cities to the coast, sort the real receipts from the fakes without any drama or upsell. Our retirement communities are a favorite target precisely because the scammers bet on worry winning out over double-checking.

And if you did call, let someone on, or sent money, we can go through the computer to make sure nothing was left behind, lock your accounts back down, and walk you through the reporting. We don't sell antivirus subscriptions or "lifetime protection plans," so the advice you get from us is honest — including telling you, most of the time, that the email was a bluff and your money was never in danger to begin with.