Fake Norton / Geek Squad Renewal Email Script
An email impersonating a security software or tech-support brand claims your subscription has automatically renewed for a large, unexpected amount and provides a phone number to call for a refund or cancellation. Calling connects you to a scammer who extracts remote access to your device under the guise of processing the refund, or claims the refund was accidentally sent too high and asks you to send back the difference via gift cards. The lever is alarm over a large surprise charge prompting an immediate call rather than checking your actual account first. The most important step is to verify any real subscription and charge by logging into your account or checking your card statement directly, not by calling the number in the email.
Last reviewed: 1 June 2026
Sanitized example messages
Illustrative, sanitized examples. Personal details are replaced with placeholders such as [phone number] and [fake link].
Your [security software] subscription has been renewed for [amount]. Your account will be charged on [date]. To cancel: [phone number].
Geek Squad Invoice [number]: Annual Protection Plan — [amount] charged. If you did not authorise this, call [phone number] within 24 hours.
Thank you for your renewal of [amount]. A receipt has been sent. To request a refund, call [phone number] immediately.
Your subscription auto-renewed. To opt out and receive a full refund, contact our billing team: [phone number] or [fake link].
What the scammer wants
To create panic about a large unexpected charge so you call, at which point the scammer extracts remote device access or payment — often claiming the 'refund' was sent incorrectly and asking you to buy gift cards to return the 'excess'.
Red flags in the message
- Large renewal charge you do not recognise, arriving only by email
- Phone number prominently displayed to 'cancel' or 'dispute'
- Urgency — act within 24 hours or the charge stands
- Email sender address does not match the brand's real domain
- No matching charge in your real bank account or card statement
- Agent on the call asks you to install remote-access software
- Agent says refund was sent as too much and asks you to return the difference by gift card
A safe response
Do not call the number in the email. Check your real account with the software provider by typing their official web address, and check your actual bank statement. Report the email as phishing and delete it.
What not to send
- Remote access to your device
- Gift-card codes to 'return' an overpaid refund
- Bank login details or one-time codes
- Personal or card details to the caller
What to do if you already replied
- If you allowed remote access, disconnect immediately and uninstall the tool
- Change all passwords from a separate clean device
- Contact your bank if any funds were moved or card details shared
- If you gave gift-card codes, contact the card issuer right away
- Report the email to your email provider and national fraud authority
Evidence to preserve
- Screenshot the full message or call details
- Note the sender number, email, or profile
- Save any links (without clicking) and payment details
- Record dates and times
Frequently asked questions
I checked my bank statement and there's no such charge — am I safe to ignore this?
Yes, if no matching charge appears on your actual statement when checked independently, the email is fake and can be deleted; there's no need to call the number to 'cancel' anything that was never charged.
I called and they remoted into my computer — what should I do?
Disconnect from the internet, uninstall the remote-access software, and get help from a trusted person if unsure how. Change your important passwords from a separate device and contact your bank if you shared any payment or account details.
They said they refunded me too much and I need to send back the difference — should I?
No — this 'overpayment' claim is a common follow-up tactic designed to get you to send them real money directly, often via gift card or transfer. Check your actual bank balance yourself; if no extra refund appears, none was sent, and you owe nothing.
I paid for a 'security subscription' renewal through this — can I dispute the charge?
Contact your card issuer to dispute the charge as unauthorised or fraudulent, since most cards offer chargeback protection in this situation. Also uninstall any software installed during the call and change related passwords.