How the fake renewal invoice works.
This one says a subscription you do not remember has just renewed for a few hundred euros. There is nothing to click. There is a number to call to cancel it, and that call is the scam.
1Geek Squad Billing
2Invoice GS-88421905: your Total Protection plan has been renewed
Thank you for renewing. Your card has been charged USD 429.99 for 2 years. If you did not authorise this renewal, contact our billing department within 24 hours at +1 (888) 402-XXXX to cancel and receive a refund.
3Invoice attached (PDF)Three warning signs
- A charge you do not recognise, and a deadline of 24 or 48 hours.
- No link and no account page: only a phone number, in the text or in a PDF.
- The sender's domain is not the brand's own (geeksquad-invoice-dept.com, not geeksquad.com), or names no brand at all.
This made-up message uses a known scam pattern. It shows no real person, firm, or email.
Why it works
The attachment usually carries no virus at all, so a security scan finds nothing wrong. The harm starts on the call: to process the refund you are asked to install remote-access software, or to type your card details into a form the caller controls. Some victims are shown a fake refund that appears too large and are then pressed to send the difference back.
What to do now
- Do not call the number. Check the charge in your bank or card app, and on the vendor's own site.
- Never install remote-access software for someone who called you, or whom you called from an email.
- If you already gave access or card details, disconnect, change the passwords from another device, and call your bank.
Klar catches spam in Apple Mail.
Klar moves spam and phishing to Junk. It cannot check who a person is or get stolen money back.
