A fake renewal scam is an email, text or letter saying you have just been charged a large sum to renew antivirus, computer support or another subscription, with a phone number to call if you want to cancel, and that phone call is where the theft begins. The message is designed to make you ring the scammer yourself. On the call you are offered a refund, asked to install remote access software and log into online banking, and then tricked into "returning" an overpayment that never happened. This guide explains how the fake invoice and refund flow works step by step, why remote access is the turning point, how to check a charge safely, and what to do if you already called or let someone into your computer. It covers the invoice and refund lure specifically; scary pop-ups and cold calls are covered in the Recognising Tech Support Scams Guide. It is written for individuals, families and small businesses, and for people who run scam awareness sessions.
Key takeaways
- Never call the number on the invoice. The FTC says to contact the company using a number you have verified yourself, not the one in the message.
- Check your statement first. If there is no matching charge on your card or bank statement, the FTC says the notice is a scam: ignore and delete it.
- No refund needs remote access. A genuine refund goes back to the card you paid with. Nobody needs control of your computer or a view of your online banking to process it.
- "We refunded you too much" is the trick. The FBI describes scammers moving money between the victim's own accounts so it looks like an overpayment, then asking for the "extra" back by wire or prepaid card.
- Act quickly if you let them in. Disconnect, call your bank, remove anything installed, change passwords and report it.
What it is
Fake renewal and refund scams are a form of callback phishing. Instead of a link to click, the message carries a phone number and an alarming amount: an annual renewal for a security suite, a computer repair plan, a streaming service or an online shopping membership. The FTC describes emails or texts that claim you were charged hundreds of dollars to renew a tech support subscription, often using the names of well-known security and repair brands, and pressure you to call quickly to dispute the charge. The brands named in these messages are being impersonated; the genuine companies are not involved.
Three variants are common:
- Fake renewal invoice: a PDF or email "receipt" for an auto-renewal you never set up, with a "cancel or dispute" phone number.
- Refund offer: a call or message offering money back for a service you supposedly no longer use, or because a company is closing. The FBI warned about this fake refund scheme as early as 2018.
- Fake order confirmation: a message thanking you for an expensive purchase, again with a number to call if you did not place it.
A separate, older pattern is the misleading renewal notice for a subscription you do have, such as a newspaper or magazine, sent by a third party that charges far more than the publisher. The FTC took action against one such scheme in 2016. If a renewal notice is for something you do subscribe to, renew only through the provider's own website or account.
How it works
The fake invoice and refund flow
- The bait: an email, text or letter shows a large charge, an order number and a phone number. Some come from free email accounts; others spoof a familiar sender name.
- The callback: worried, you ring the number. Because you started the call, it feels safer, which is exactly why the scam uses this route.
- The refund offer: a friendly "agent" agrees to cancel and refund. The FTC notes callers may send you to a spoofed website and ask for card or bank details "to process the refund".
- Remote access: you are asked to install a remote support app so they can "process the refund". The FBI notes that if you are on a phone or tablet, they may tell you to switch to a computer first.
- Online banking: you are asked to log into your bank "to receive the refund". With control of the screen, the scammer moves money between your own accounts or edits what the page displays.
- The overpayment: the agent says a mistake was made and you were refunded far too much, often with an emotional story about getting into trouble. You are asked to send the difference back by gift card, wire transfer, bank transfer, cryptocurrency or payment app.
- Repeat and escalate: the FBI notes this can repeat several times, costing thousands. Some scams then pass you to a fake bank or government official who says your accounts are compromised and money must be moved to "protect it".
The "phantom hacker" escalation
The FBI's 2023 "Phantom Hacker" warning describes a three-phase version: a tech support impostor gains remote access and asks the victim to open financial accounts; a fake bank or brokerage employee then claims a foreign hacker is in the accounts and asks for money to be moved to a "safe" account by wire, cash or cryptocurrency; and finally a fake government official, sometimes claiming to be from the Federal Reserve, sends official looking letters to keep the pressure on. The FBI reported 19,000 tech support scam complaints with estimated losses over $542 million from January to June 2023, with nearly half of reporting victims over 60 accounting for 66 per cent of losses. The FTC is clear that government workers never ask you to move money to protect it.
Red flags in an invoice or call
| What you see | Why it matters | Safe action |
|---|---|---|
| Renewal for a product you do not remember buying | The FTC says no matching charge on your statement means the notice is a scam | Check your card and bank statements, then delete |
| A phone number to call to cancel or dispute | The callback is the attack; the number goes to the scammer | Use the contact details on the company's own website or your account |
| A large, round amount and a short deadline | Urgency is a pressure tactic the FBI names | Slow down; a genuine charge can be disputed later with your card issuer |
| Request to install remote access software | Remote access gives control of your screen, files and banking | Refuse and hang up |
| Request to log into online banking during the call | The refund trick depends on it | Never log into banking while someone else is connected |
| "We refunded too much, please send it back" | The FBI describes the overpayment as staged with your own money | Hang up and call your bank on the number on your card |
| Payment by gift card, crypto, wire or payment app | The FTC notes these are hard to reverse | Refuse; no real company asks for refunds back this way |
| Hand-off to a "bank investigator" or "federal agent" | The FBI's phantom hacker pattern | End the call; real officials do not ask you to move money |
Why it matters
The refund and renewal lure reaches people who would never fall for a crude pop-up, because the message looks like ordinary admin and invites a sensible action: calling to cancel. Once remote access is granted, the risk goes beyond one payment. Microsoft warns that while scammers appear to make repairs, they may be stealing information or installing malware, and the FBI describes scammers asking victims to open their financial accounts on screen so they can pick the most valuable one to target. Saved browser passwords, email and documents are all exposed, which can lead to account takeover and identity fraud weeks later.
Small businesses are targeted too: a fake renewal invoice for software or a domain sent to an accounts inbox may simply be paid. Treat unexpected renewal invoices like any other supplier invoice and verify them through the account you already hold. For supplier payment fraud see the Invoice Redirection Fraud Guide.
How to check a charge safely
| Step | How to do it |
|---|---|
| 1. Look at your own records | Check card, bank and payment app statements for the exact amount and date. No matching charge means the notice is fake |
| 2. Log in to the account yourself | Type the provider's web address or use its official app, and look at subscriptions and billing there |
| 3. Contact the provider independently | Use the support details on the official website or in the app, never those in the message, and be careful with sponsored search results, which the FBI warns can lead to scam numbers |
| 4. Dispute real charges through your card issuer | If a charge is real and unwanted, your bank or card issuer can help; the FTC advises reporting unauthorised transactions and asking for a reversal |
| 5. Report the message | In the UK, forward scam emails to the NCSC reporting address and scam texts to 7726; in the US, report to the FTC at ReportFraud.ftc.gov |
If you called, paid or gave remote access
- End the call and disconnect: turn off Wi-Fi or unplug the network cable so the scammer cannot reconnect.
- Call your bank: from another phone if possible, using the number on your card. In the UK, 159 reaches most banks. Ask them to check for transfers and stop further payments. The FBI advises contacting your financial institutions if an account or device was compromised.
- Contact payment providers: for gift cards contact the issuer; for wire transfers the wire company; for payment apps the app provider.
- Remove the remote access app: uninstall any software they asked you to install, then run a full security scan with your system's built-in security tools. If unsure, get help from a repair service you already know.
- Change passwords: the FTC advises changing your password right away, and anywhere else you used it, starting with email and banking. Turn on two-step verification.
- Report it: in England, Wales and Northern Ireland to Report Fraud (which replaced Action Fraud on 4 December 2025) online or on 0300 123 2040, in Scotland to Police Scotland on 101, and in the US to the FTC and to IC3. The FBI asks you to keep all related documents and communications, and to include names, phone numbers, websites and recipient account details.
- Watch your credit: if personal documents were on the computer, consider a credit freeze; see the Credit Freezes and Fraud Alerts Guide.
The full recovery path is in the What to Do If You Have Been Scammed Guide.
Common misconceptions
- "I called them, so it must be safe." Calling a number from a scam message connects you to the scammer. Safety comes from where you found the number.
- "My balance went up, so the refund was real." The FBI describes scammers moving money between your own accounts. Your balance shows your own money.
- "They had my name and email, so it is a real company." Names and email addresses are widely available from leaks and marketing lists.
- "The invoice has the right logo." Logos are easy to copy. Check the charge in your own account instead.
- "Antivirus will stop this." Security software helps, but cannot stop you from granting remote access yourself.
- "Only older people fall for it." Older people lose the most, but busy professionals and small business staff pay fake invoices too.
Related concepts
- Tech support scams: pop-up and cold call versions of the same remote access trick. See the Recognising Tech Support Scams Guide.
- Phishing emails: fake invoices are phishing with a phone number in place of a link. See the How to Spot a Phishing Email Guide.
- Impersonation: the fake bank and government stages. See the Impersonation Scams Guide.
- Overpayment and fake cheques: the same "send back the difference" mechanic. See the Prize, Lottery and Inheritance Scams Guide.
- Shopping account scams: fake order and membership renewal messages. See the Amazon Account Security and Scams Guide.
Practitioner checklist
- Never call a phone number taken from an unexpected invoice, receipt or order confirmation.
- Check any claimed charge against your own statements and the provider's account page.
- Find support numbers on the provider's official website or app, and treat sponsored search results with care.
- Refuse any request to install remote access software from someone you did not contact through a trusted route.
- Never log into online banking while another person can see or control your screen.
- Treat any "overpayment" story as a scam and hang up.
- If you gave access or paid: disconnect, call your bank, uninstall the app, scan, change passwords and report.
- For businesses, verify every unexpected renewal invoice through the existing supplier account before paying.
- In awareness sessions, show a sample fake invoice and teach "check your statement, not the email".
Standards and references
- Federal Trade Commission: How to spot, avoid and report tech support scams
- FBI Internet Crime Complaint Center: Tech Support Fraud (I-032818-PSA)
- FBI Internet Crime Complaint Center: Phantom Hacker scams target senior citizens (I-091223-PSA)
- National Cyber Security Centre: Reporting a scam email
- Microsoft Support: Protect yourself from tech support scams
- Federal Trade Commission: Fake subscription notices for newspapers
Related NHI Mgmt Group resources: Recognising Tech Support Scams Guide · What to Do If You Have Been Scammed Guide · How to Spot a Phishing Email Guide · Consumer Reporting Routes Map