Fake invoice, callback

A confirmation for an expensive order you did not place — a phone, a laptop — with a "fraud department" number to call if it was not you. The number leads to a script that asks for remote access or payment "to reverse the order".

An email says a Geek Squad or Best Buy protection plan has been renewed and a sum has been charged. The invoice number and a helpline phone number are the point of the message: the call is where the money is taken, usually through remote access "to process the refund". Some variants add a link to a fake sign-in page instead.

A fake "order confirmation" or "auto-renewal" for McAfee Total Protection with an amount and a number to call to cancel. The brand rotates; the call centre behind the number is the same trade.

An email claims a Norton or LifeLock subscription was auto-renewed and a sum charged, and gives a phone number to cancel. Same mechanics as the Geek Squad family with a different brand skin; Norton documents the pattern on its own support site.

A genuine-looking PayPal invoice or money request, often "from" a crypto exchange or a retailer, with a phone number in the note "if you did not authorise this". The invoice may really come through PayPal's system, which is why it passes filters; the number is the scam.