The fake Geek Squad or Norton renewal email: why the phone number is the trap

The Geek Squad renewal email scam looks like paperwork. A tidy invoice, an order number, a line saying your protection plan has renewed for a few hundred dollars, and a phone number to call within 24 hours if you want to cancel. The same email goes out wearing Norton and McAfee logos. It lands in personal inboxes and in the shared billing mailbox at offices across Denver, Boulder and Arvada, where whoever handles the bills is the person most likely to pick up the phone.

That phone call is the whole scheme. This post covers what happens on it, how to check a charge without making it, and what to do if you already did.

Why the Geek Squad renewal email scam uses a phone number

Most phishing needs you to click something. This kind, sometimes called callback phishing, asks you to do the contacting. The email itself is often harmless to open. The persuasion happens live, with a calm person who sounds like customer service and has an answer for every doubt.

The FBI described the pattern in a 2022 public service announcement. The subject line hints at a renewal, generally within the next 24 hours, for something like a computer protection plan or warranty. The price is commonly in the range of $300 to $500, enough to worry you and small enough to be believable. The number is sometimes made to look like a toll-free service line.

It is common. The Federal Trade Commission reported that more people reported impersonation of Geek Squad in 2023 than any other company, and that those reports grew more than 100-fold between 2020 and 2023.

If you'd like a second opinion on a message before doing anything else, paste it into Reported, our free scam checker. It reads the email in your browser and uploads nothing.

What happens when you call

The FTC and FBI accounts line up closely. The call tends to go like this:

1. A friendly agent agrees to cancel. They may even offer a larger refund than the charge, which the FBI notes is an enticement to keep you cooperating.
2. They ask for remote access. You are told to download a remote-control program so they can "process the refund." That gives a stranger full control of your computer. The FTC warns they can then install spyware and steal your online banking sign-in.
3. They have you open your bank account. You are asked to sign in to confirm the refund arrived. According to the FBI, the scammer can capture your sign-in details at that moment, then lock you out or put up a black screen while moving money out.
4. Or they "refund too much." The agent fakes a transaction, or makes a deposit look like a mistake, and claims they sent you far more than they meant to. You are asked to send back the difference. The FTC says this is often by buying gift cards and reading out the numbers and PINs. The FBI has also seen victims talked into wiring the money themselves.

The money you "return" was yours all along.

How to check the charge without calling

• Look at your statement first. Sign in to your bank or card account the way you normally do. The FTC's guidance is direct: if you see an unauthorized charge, report it to the bank or card issuer and ask them to reverse it. If there is no charge, the message was a scam. Delete it.
• Check the real account. If you do have a plan with Best Buy or Norton, type the company's web address yourself and look at your subscriptions there.
• Use a number you already trust. One from a receipt, the back of your card, or the company's own site. The FTC's wording: do not use the number included in the message.
• Read the sender's address, not the display name. Norton publishes the domains its real mail comes from, such as norton.com and subscriptions.norton.com. A renewal notice sent from a free webmail address is not from them.

Real renewal reminders exist. Norton lists them among the emails it sends. That is why a renewal notice alone proves nothing either way, and why the check has to happen in your own account, not in the email.

If you already called: a checklist

Plenty of careful people have made this call. What matters is the next hour.

1. End the session. Hang up, disconnect the computer from the internet, and stop using it for banking.
2. Call your bank from a different phone or device. Use the number on the back of your card. Tell them a scammer may have had access to your account and ask them to reverse any payment.
3. If you bought gift cards, contact the card's issuer right away, say the numbers were given to a scammer, and ask for a refund. The FTC says to keep the card and the receipt.
4. Clean the computer. The FTC's steps: update your security software, run a scan, and delete whatever it flags. Remove any remote-control program you were asked to install. If you are not sure it is clean, have someone you trust look at it.
5. Change your passwords from a different device. Email and banking first. Turn on two-step sign-in. Our guide to checking whether a password has leaked covers the order to do it in.
6. Report it. ReportFraud.ftc.gov for the FTC, and ic3.gov for the FBI, especially if money was wired. Norton asks for fake Norton emails to be forwarded as an attachment to spam@norton.com.

For a small office

At work the stakes are different. The computer a scammer is invited onto may hold the accounting software, saved browser passwords and client files. Three rules cover most of it:

• Nobody calls a number from an invoice email. Vendor numbers come from your own records. It is the same rule that stops fake-invoice fraud.
• Nobody installs remote-control software because a caller asked. The FBI's advice is not to grant remote access to unknown people, and not to do any banking while someone has it.
• Keep a list of what you actually subscribe to. If the person paying the bills can check a one-page list, a fake renewal is obvious in seconds.

At Lab 5280 we work with your team, not just for you, and our focus is on automating how a business runs. That includes the dull parts, like one clear place where subscriptions and vendor contacts live, so a surprise invoice gets checked against a record instead of a phone number in an email.

Common questions

Is a Geek Squad or Norton renewal email always a scam?

No. Real renewal reminders exist, so the notice alone proves nothing. Check your card statement and sign in to the real account yourself, and never use the contact details in the email.

What happens if I call the number?

A friendly agent offers to cancel or refund, then asks for remote access to your computer. The FTC and FBI describe this leading to stolen banking sign-ins, or a fake overpayment story that ends with you sending money.

What should I do if I already called?

Hang up, disconnect the computer from the internet, and call your bank from a different phone using the number on the back of your card. Then clean the computer, change your email and banking passwords from another device, and report it at ReportFraud.ftc.gov.

Sources