The fake invoice arrives looking boring on purpose: a renewal notice for Norton, Geek Squad, McAfee, or a PayPal charge — a few hundred dollars, auto-billed tomorrow, with a phone number to call 'to cancel'.
The invoice isn't the scam. The phone call is. The 'cancellation department' will refund you — they just need remote access to your computer to 'process it'. Then a fake refund screen shows too much money, and you're begged to send back the difference. Victims lose thousands; the invoice only asked for $349.
How the scam works
1
The bait
An emailed invoice or renewal notice for software you may not even use, from a generic address, often as a PDF or image.
2
The callback
You call to cancel. The agent is friendly and 'processes your refund' — but needs you to install remote-access software like AnyDesk or TeamViewer.
3
The fake refund
With screen control, they fake a bank transfer that 'accidentally' refunds too much — often by editing the HTML on your banking page while you watch.
4
The reverse extraction
Panicked and apologetic, they beg you to return the overage — by wire, gift cards, or even cash mailed in a box. That money is real and unrecoverable.
Red flags to watch for
!A renewal for something you don't remember buying
Check your actual card and bank statements — not the invoice — for any such subscription. Usually there isn't one.
!Call-to-cancel with urgency
Real subscription services let you cancel online. A phone number as the only way out is callback bait.
!Remote access for a refund
No refund on earth requires controlling your computer. This is the moment the scam becomes dangerous.
!Generic sender, real logos
The email comes from a Gmail or random domain, dressed in stolen branding.
!An 'overpaid refund' you must return
The extra money on your screen was never real. Anything you send back is your real money leaving.
What to do
✓Don't call the number
Verify any charge in your own records: card statements and the service's real website. No charge, no problem — delete the email.
✓Never install remote-access software for a 'refund'
If you already did, disconnect from the internet, uninstall it, run a malware scan, and change your banking passwords from another device.
✓If money left your account
Call your bank immediately to attempt a recall and secure the account. Report at reportfraud.ftc.gov and ic3.gov.
✓Check the message with Scambook
Paste the invoice email into our checker — these templates are heavily reported and light up instantly.
Frequently asked questions
The invoice shows my real name and email. Doesn't that mean they have my account?
No. Names and emails circulate in breach data by the billions. Mail-merged 'invoices' use them to look personal. What matters is whether a charge exists in your actual bank records.
I called but hung up before doing anything. Am I at risk?
Calling only confirmed your number is live — expect more attempts. As long as you didn't grant remote access or share card details, no direct harm was done. Block the number.
Can I just reply to cancel the subscription?
Don't engage at all. Replying confirms your address is monitored and invites the callback script through another channel.
Got a message that looks like this scam?
Paste it into Scambook's free AI checker for an instant verdict, or look up the phone number or website that contacted you.
Scambook