Geek Squad renewal invoice scam
An email says a Geek Squad or Best Buy protection plan has been renewed and a sum has been charged. The invoice number and a helpline phone number are the point of the message: the call is where the money is taken, usually through remote access "to process the refund". Some variants add a link to a fake sign-in page instead.
- Impersonates
- Geek Squad (Best Buy)
- Arrives by
- First seen
- 2021-07
- Specimens
- 1
- Updated
- 2026-09-02
Right now the only version we have seen
How to recognise it
- You have no Geek Squad or Best Buy subscription, yet the email knows nothing about you either — no name, no account, no last four digits
- A charge you do not recognise, and one way to dispute it: a phone number
- The sender is a free mailbox or an unrelated domain behind a "Geek Squad" display name
- Some copies carry a link to a "sign-in page" that only collects your details
What to do
- Do not call the number, do not reply, delete the email
- If you do have a Best Buy account, check it by typing bestbuy.com yourself — never through the email
- Nothing was charged; the invoice does not exist
Already called, clicked or paid? what to do in the next hour
- Gave remote access? Disconnect from the internet, uninstall the tool they had you install, change passwords from another device
- Paid by card or bank transfer? Call your bank now and dispute it. Gift cards? Call the card issuer with the card numbers
- Expect a call-back from a "refund department" — that is act two of the same scam. Hang up
How it changed
nothing to compare yet · one wave on record2021-07the renewal invoice with a helpline number
Got a different version? A new subject line, sender, number or domain becomes the next point on this line. Redacted before publication. Send it →
02 Sept2026
Registry
Family created
Grew out of the 2021 guide "Geek Squad scam 2021 – how to identify and stay safe", which stays online unchanged.
11 Jul2021
Specimen
Specimen №1: the renewal invoice with a helpline number
The 2021 guide documented the first wave: an invoice-style email with an amount "charged", an invoice number and a phone number to dispute it; some copies linked to a fake sign-in page. The screenshot from that guide is the first specimen on record.
Channel
email
Same trick, other brands
- Norton renewal invoice scamactive · 2026-09
- McAfee renewal invoice scamactive · 2026-09
- PayPal invoice / money-request scamactive · 2026-09
- Amazon "order confirmation" callback scamactive · 2026-09
Indicators
- None on record yet. Indicators change weekly; an empty list never means an email is safe.
In other streams
Registry data
- Machine-readable
/scams/geek-squad-renewal-invoice.json- Timeline feed
/scams/geek-squad-renewal-invoice/feed.xml- Sources
- 1 · 1 change logged
- Licence
- CC BY 4.0 · attribution required
- Created / updated
- 2026-09-02 / 2026-09-02