Is This Refund or Renewal Notice a Scam? 7 Red Flags

Instant check · $2, one-time

Check the notice's link right now

Copy the link from the renewal email or text (don't click it) and paste it here. Free risk signal in seconds; the full 0–100 report with evidence is $2, one time.

The full checklist

The 7 red flags of a refund scam

Refund scams impersonate names you trust — Geek Squad, McAfee, Norton, Amazon, PayPal, your own bank — and weaponize a moment of panic about money. The costumes rotate; the script underneath never changes. These are the seven signs.

Check a link — $2

01

A charge you never made

“Your Geek Squad protection plan has auto-renewed: $499.99.” You never bought it — that's the hook. The invoice exists to make you dial the number, and the number is where the real scam begins.

02

The phone number in the message

Real companies cancel through your account on their official site. A message whose only path is “call this number to dispute” routes you to the scammer's call center, staffed and scripted. Never call numbers from unexpected invoices.

03

Remote access “to process the refund”

On the call, the “agent” needs you to install AnyDesk, TeamViewer, or “our secure refund portal” — which is screen-sharing. From there they can watch you type, or black out your screen while they work. No legitimate refund requires software on your computer.

04

The “we refunded too much” turn

You're told to log into your bank “to confirm the refund,” they manipulate what you see on screen, and suddenly it looks like they sent $40,000 instead of $400 — and now you must “return the difference.” The over-refund is a visual trick; your balance was never touched.

05

Repayment in untraceable form

Gift cards read aloud, a wire, crypto, a Zelle to a “manager.” Real companies reverse charges through the card network — they never need you to buy gift cards at Target. The payment method alone settles it.

06

A sender address in costume

“Geek Squad” writing from a Gmail address, “McAfee” from a domain registered last week, “PayPal” from paypal-billing-secure.com. Expand the sender field: the display name is a costume; the address is the identity.

07

Panic on a timer

“Call within 24 hours or the charge is final.” “Your account will be debited today.” The countdown exists to stop you checking your card statement first — which is the one move that defuses the entire scam.

What to do now

Think this refund notice is a scam? Do this now

1

Don't call the number, don't click the link

Close the message. Check your actual card and bank statements for the charge yourself — in the app or the site you navigate to. If the charge isn't there, nothing was ever going to be “refunded.”

2

Verify through official channels

If the charge really is on your statement, contact the company through its official website or the number on the back of your card — never the contact details inside the message. Real subscriptions show up in your real account.

3

Check the link, then report it

Run the message's link through Scam Detective for a 0–100 risk score, then report at ReportFraud.ftc.gov. If you gave remote access or watched your bank on their call: disconnect from the internet, call your bank now, and change passwords from a clean device.

Questions

Asked by people in your exact spot

I called the number and let them see my screen. What now?

Act in order: disconnect the device from the internet, uninstall anything they had you install, then call your bank from a different, clean device and explain that a scammer may have had remote access. Change your banking and email passwords, turn on two-factor authentication, and watch your statements for weeks.

They showed the refund in my bank account — I saw it.

You saw an edited screen. With remote access, scammers manipulate what your browser displays — the “$40,000 refund” is pixels, not money. Your real balance is what your bank sees when you call them directly. Never return money based on what a stranger's screen showed you.

I actually have a Geek Squad / Norton plan. Could the email be real?

It could be — so check in the one place that can't lie: your account. Log in at the company's official website, typed yourself, and look at your subscriptions and payment history. If nothing renewed there, the email is fake no matter how real it looks.

Can you check the link from a renewal email?

Yes — copy the link without clicking it (right-click or long-press → copy link) and paste it into the checker above. The free signal takes seconds; the $2 full report weighs domain age, impersonation signals, phishing markers, and payment red flags, each with evidence.

Checking something else?