My brother-in-law Gary is a retired accountant, so he notices numbers. When an email showed up saying his computer protection plan had auto-renewed for $399.99, he nearly dropped his coffee. He didn't remember buying any protection plan.
The email had a logo, an invoice number, and a friendly line at the bottom: "If you did not authorize this charge, call our billing department within 24 hours for a full refund." So Gary called. A polite man said he'd process the refund, but he needed to "connect to your computer" to do it. Gary let him in.
Well, folks, twenty minutes later the man said, "Oh no, I accidentally refunded you $3,900 instead of $399. You'll need to send back the difference." He wanted it in gift cards. That's when Gary's wife, Pat, walked in, saw a stranger moving the mouse on his screen, and unplugged the computer from the wall.
Is a surprise renewal email usually a scam?
Very often, yes. The FTC warns about exactly this in its guide to tech support and refund scams. The email invents a charge you never made so you'll call the number in it. The whole point is the phone call.
Logos, invoice numbers, and official-looking layouts are easy to copy. None of them prove a charge is real. The only thing that proves it is your own bank or card statement.
How do I check if the charge is real?
In plain words: don't call the number or click anything in the email. Open your bank or credit card app, or look at your statement, the way you normally do, and search for the charge. If a real charge is there, contact the company through its official website or the number on your card, never the email.
Gary checked his card statement the next morning. There was no $399.99 charge. There never had been.
What are the signs of a fake renewal or refund scam?
Put simply, watch for four signs: a charge for something you don't remember buying, a phone number in the email to call for a refund, a request to connect to your computer, and a "refund mistake" you're asked to pay back with gift cards, a wire transfer, or cryptocurrency. Any one of them is enough to stop.
Should I reply to the email or click "unsubscribe"?
No to both. Replying tells the scammer your email address is real and that someone reads it, which can bring on more scam emails. The "unsubscribe" link in a fake email can lead to the same kind of copycat website. Just delete it, or use your email's "Report spam" or "Report phishing" button so it's filtered out next time.
If you'd like to warn others, you can forward phishing emails to reportphishing@apwg.org, a group that works with email providers to block them, and report the scam to the FTC.
What if I already let them into my computer?
Do what Pat did: disconnect the computer from the internet right away. Then, from a different device, call your bank using the number on your card and tell them what happened. Change your important passwords, starting with email and banking. Have a trusted local repair shop check the computer before you use it for banking again. Then report it at ReportFraud.ftc.gov.
If you only clicked a link, our guide on what to do after clicking a suspicious link has the cleanup steps. And if a "bank" ever calls asking you to move money, read why your bank will never ask that.
What Gary does now
Gary's bank froze his accounts that same day, and he didn't lose a penny. A repair shop cleaned up his computer for $80, which he calls "the cheapest lesson I ever paid for." Now every surprise invoice goes straight into a folder he labeled "Check the card first."
Scammers are counting on you to call, folks. Check your own statement instead, and the scam falls apart.
Have you gotten a fake renewal email like Gary's? Tell us in the comments what company it pretended to be.
