The fake subscription-renewal scam: an invoice for something you never bought

A receipt lands in your inbox: your antivirus subscription, a “PC protection plan,” or your Geek Squad membership is auto-renewing — and you are about to be charged a few hundred dollars. There is a generic greeting, a note that your account is “on hold” over a billing problem, and a phone number to call if you want to cancel or dispute it. The catch is simple and counterintuitive: there is usually no charge at all. The invoice is the bait, and the phone number is the trap.

Why the invoice itself is the lure

Most scams that arrive by email push you toward a link. This one often does the opposite — it may have no working link at all, just a number to call. That is deliberate. The FTC, describing the fake Geek Squad version, says you “get a text message or email that says you were or will be charged hundreds of dollars to renew” a membership, with a generic greeting and a claim that “your account is on hold because of a billing problem.”

The goal is to get you on the phone, because everything dangerous happens there. If you call the number — “which you should not do,” the FTC warns — “the scammer might ask for remote access to your computer,” and if you grant it, “they can install spyware programs on your computer, steal your online banking credentials, and drain money from your bank account.”

How the call plays out

The FBI lays out the sequence in its 2023 alert on tech-support scams targeting older adults. The scammer “informs the victim of fraudulent activity or potential refund for a subscription service,” then “convinces the victim to download a software program allowing the scammer remote access.” From there it becomes a refund trick: the scammer “supposedly transfers an amount to the victim’s bank account but ‘accidently’ deposits a much larger amount than intended,” and “tells the victim to return the extra money or the scammer will lose their job.”

The “extra money” is never real — it is your own funds shuffled between your accounts, or a faked on-screen balance. From here the demand turns to untraceable payment: gift cards, wire transfer, or, in the FBI’s account, cash “wrapped in a magazine(s)” and sent “via a shipping company.” This is the same machinery as the refund and overpayment scam — the renewal invoice is just the doorway into it.

The decisive rule

You do not need to judge whether the invoice looks real. You need one habit: a real charge appears on your statement, not only in an email. The FTC’s bottom line is that “legitimate tech companies won’t contact you by phone, email, or text message to tell you there’s a problem with your computer,” and that if you think a message could be real, you should “verify the story by contacting the organization using a phone number, website, or email address you know is real.”

That is the Go Direct move:

1. Don’t call the number or click the link in the message. The number is not the company; it is the scammer.
2. Check it yourself. Log into your account on the company’s real website (type the address or use a bookmark), or call the number on the back of your card or on your statement.
3. Search the company name plus “scam.” The FTC suggests this to see whether others got the same fake renewal notice — and the same phony “support” numbers turn up the same way you can be steered to a scam customer-service number.
4. Never grant remote access or buy gift cards to resolve a billing or refund problem. No legitimate company works that way.

If you already called and let someone in, treat it as a compromise: disconnect, run a scan, call your bank on an official number, change passwords from a clean device, and report it at IC3.gov. For more, see the defense library or test your eye on the 60-second quiz.