Antivirus Auto-Renewal 'Refund' Scam
A fake invoice says your antivirus just auto-renewed for a few hundred dollars; when you call to 'cancel and refund,' they take remote control and drain your bank.
Think a message like this reached you? You can check it right now.
What this scam is
You receive an email 'invoice' or 'receipt' saying your Norton, McAfee, or Geek Squad subscription auto-renewed for $300–$500, with a phone number to dispute or cancel. There was no charge; the invoice is bait. When you call, a 'representative' offers a refund, has you install screen-share software to 'process' it, and then fakes an overpayment and pressures you to send the 'difference' back — draining your account. It is a tech-support/refund con wrapped in a subscription receipt.
What it usually looks like
- An 'auto-renewal' invoice for antivirus you may not even use.
- A large amount and a phone number to 'cancel' or dispute.
- A rep who wants to screen-share to 'refund' you.
- A claim they refunded too much and you must return it.
Common warning signs
- An invoice for a subscription you don't recognize.
- A phone number as the only way to dispute.
- Being asked to install software or share your screen for a refund.
- A story about being overpaid and needing money back.
Example wording scammers use
“Thank you for renewing Norton 360 — $429.99 has been charged. To cancel and refund, call 1-8XX.”
“Geek Squad Protection auto-renewed for $399. Dispute within 24 hours at the number below.”
These are illustrative examples written by ScamSplain, not real messages.
What the scammers want
- You to call and grant remote access.
- To fake an overpayment and take 'the difference.'
- To drain your bank account.
What to do
- Do not call the number on an unexpected 'renewal' invoice.
- Check for real charges in your bank/app and the vendor's official account page.
- Never install screen-share software or send money for a refund.
- Delete the email and report it.
What to do if you already responded
- Call your bank's fraud line and change online-banking credentials.
- Uninstall any screen-share tool and scan your device.
- Report to ic3.gov and reportfraud.ftc.gov.