Fake Norton, McAfee or Geek Squad Renewal Invoice Emails: What to Do

A message saying your Norton, McAfee or Geek Squad subscription was renewed for hundreds of dollars, with a phone number to call to dispute it, is usually a scam. Do not call the number, open attachments or click links. Check your bank or card statement and sign in to the company's real website to see whether you have a subscription, then report the message to the FTC. This guide covers how to check, what to do if you already called or paid, and how to report. It was checked against FTC and Norton pages on October 31, 2026.

Who this is for and what you will have at the end

This guide is for anyone who received an unexpected invoice, order confirmation or "auto-renewal" notice by email, text or phone for antivirus software or a tech support membership, and is not sure whether it is real. By the end you will be able to verify the charge without using the scammer's contact details, secure your computer and accounts if you engaged with them, and report the scam.

How the scam works

The FTC describes the Geek Squad version. You get a text or email saying you were or will be charged hundreds of dollars to renew a Geek Squad membership, with scammers posing as Best Buy's tech support service. To dispute or cancel, the message says you must call a phone number within 24 hours.

The FTC's tech support guidance describes what follows:

• Callers may ask for remote access to your computer. The FTC says that if you grant it, scammers can install spyware, steal online banking credentials and drain your account.
• Some ask for your bank account details to "refund" you. They then fake a transaction, claim they refunded too much by mistake, and tell you to pay them back, often with gift cards, wire transfers, cryptocurrency or payment apps.

Norton describes the same pattern for its brand: an email with a Norton renewal notice, an attached invoice, and a phone number "to cancel a pending credit card charge." It also describes fake order confirmations in shopping apps for Norton products you never bought, with fake support numbers. The FTC names McAfee alongside Geek Squad and Norton among the brands scammers use.

Why it works

The message is built to make you act before you think. A large charge, a short deadline and a phone number give you one obvious way to "fix" it. The FTC's response is simple: scammers send alarming messages to rattle you, so do not let them.

Warning signs

Step 1: Do not call, click or open anything

Do not use the number included in the message. The FTC's advice is to contact the company only by a phone number you know is genuine. Do not open attachments, scan any QR code in the message or click links. Norton likewise advises not to call numbers listed in unexpected notifications.

Step 2: Check whether the charge is real

1. Look at your statements. Check your credit card and bank account for any charge matching the message. If there is no matching transaction, the message is not describing a real charge. The FTC says that if you find an unauthorized transaction, you should report it to your bank or card company and ask them to reverse it.
2. Check the account yourself. Norton advises checking any unexpected charge or order directly through your Norton account or official Norton support channels. For McAfee or Best Buy's Geek Squad, type the company's address into your browser or open its official app rather than following a link in the message.
3. Look at the sender. Check for unfamiliar domains and spelling mistakes in the address. Norton publishes guidance on verifying that an email from Norton is legitimate.
4. Call only a number you trust. If you still think the message might be real, find the company's number from its website, your account, or the card you used, not from the message.

If you never subscribed and nothing appears on your statements, you can stop here and move to reporting.

Step 3: If you already called, paid or gave access

Different situations need different steps. These follow the FTC's "What To Do if You Were Scammed" page.

You called but did nothing else

Hang up and do not call back. Do not give anyone remote access, bank details or gift card numbers, and do not buy gift cards for anyone who calls about a refund or payment. Watch for follow-up calls and treat them the same way.

You gave them remote access to your computer

1. Update your security software and run a full scan.
2. Delete anything the scan flags as a problem.
3. Change your passwords and turn on two-factor authentication. Do this from a device you trust, preferably not the affected computer until it is cleaned.
4. If you need help removing malware, contact the device manufacturer or a trusted tech professional.
5. Check your bank accounts for unauthorized activity.

If the contact began with a browser pop-up rather than an email, see fake tech support pop-ups: what to do.

You paid or sent money

The FTC lists these steps by payment method:

For payment-app losses, Zelle, Venmo and Cash App scams has more detail.

You shared personal information or passwords

• If you gave your Social Security number and a scammer used it, report it at IdentityTheft.gov and follow the recovery plan. If it was not used or you are unsure, follow IdentityTheft.gov/databreach.
• If you gave an account login and can still sign in, create a new strong password, change it anywhere you reused it, and turn on two-factor authentication.
• If you cannot sign in, use the FTC's account recovery links for popular platforms.

Step 4: Report the message

• FTC: Report tech support and impersonation scams at ReportFraud.ftc.gov. The FTC uses reports to build cases against scammers.
• Norton: Forward suspicious emails as an attachment to [email protected], then delete them. For fake shopping-app notifications, report the fraud in the app if possible, send the message to [email protected], and ignore or delete it.
• McAfee and Geek Squad: Check the company's official support site, which you reach by typing its address yourself, for how it wants phishing reported. Also use your email provider's report phishing or spam option.

Reporting helps even when you lost nothing, and keeping the original message gives investigators more to work with.

Troubleshooting

I cannot tell whether the charge is mine

Look for an actual charge with the merchant's name on your statement, and check the email account you used to sign up for the product. Genuine renewals appear in your account's billing history on the vendor's site. If you want to stop auto-renewal on a real subscription, do it inside that account, not through a phone number in an email.

The message knows my name or my email address

Scammers often have this from earlier data leaks, so it does not make the message real. Verify through your statements and the vendor's website.

I clicked a link or opened an attachment

The FTC's staff guidance for this case is to update your security software, run a scan, and remove anything flagged. Then change passwords for important accounts, starting with email and banking.

They keep calling me

Do not answer unknown numbers, and do not return missed calls. Consider your phone carrier's tools for blocking spam calls.

Checklist

• Do not call the number, click links or open attachments in an unexpected invoice.
• Check your card or bank statement for a matching charge.
• Verify through the company's own website, typed yourself, or a phone number you already trust.
• Never give remote access, bank details or gift card numbers to someone offering a refund.
• If you did, scan your computer, change passwords, enable two-factor authentication and call your bank or card issuer at once.
• Report to ReportFraud.ftc.gov, and forward fake Norton emails to [email protected].

References

• FTC, How to recognize a fake Geek Squad renewal scam: https://consumer.ftc.gov/consumer-alerts/2022/10/how-recognize-fake-geek-squad-renewal-scam
• FTC, How to spot, avoid and report tech support scams: https://consumer.ftc.gov/articles/how-spot-avoid-and-report-tech-support-scams
• FTC, What to do if you were scammed: https://consumer.ftc.gov/articles/what-do-if-you-were-scammed
• Norton Support, Cyber scams and how to avoid them: https://support.norton.com/sp/en/us/home/current/solutions/v105274822
• FTC, report fraud: https://reportfraud.ftc.gov