{
  "slug": "geek-squad-renewal-invoice",
  "canonical_name": "Geek Squad renewal invoice scam",
  "family": "fake-invoice-callback",
  "impersonates": {
    "brand": "Geek Squad (Best Buy)",
    "disclaimer": "Geek Squad is not involved; criminals impersonate the brand.",
    "official_fraud_page": null
  },
  "goal": [
    "callback",
    "remote-access",
    "payment"
  ],
  "channels": [
    "email"
  ],
  "summary": "An email says a Geek Squad or Best Buy protection plan has been renewed and a sum has been charged. The invoice number and a helpline phone number are the point of the message: the call is where the money is taken, usually through remote access \"to process the refund\". Some variants add a link to a fake sign-in page instead.",
  "status": "active",
  "first_seen": "2021-07",
  "last_seen": null,
  "recognise": [
    "You have no Geek Squad or Best Buy subscription, yet the email knows nothing about you either — no name, no account, no last four digits",
    "A charge you do not recognise, and one way to dispute it: a phone number",
    "The sender is a free mailbox or an unrelated domain behind a \"Geek Squad\" display name",
    "Some copies carry a link to a \"sign-in page\" that only collects your details"
  ],
  "variants": [],
  "specimen": {
    "date": "2021-07",
    "channel": "email",
    "from": null,
    "reply_to": null,
    "subject": null,
    "attachment": null,
    "body_text": null,
    "redactions": [],
    "image": "/wp-content/uploads/geek-squad-scam-email.png",
    "sources": [
      "https://soft2secure.com/knowledgebase/geek-squad-scam"
    ]
  },
  "tells": [],
  "indicators": {
    "sender_domains": [],
    "senders": [],
    "reply_to": [],
    "phone_numbers": [],
    "urls": [],
    "wallets": [],
    "attachments": [],
    "note": "Indicators change weekly; an empty list never means an email is safe."
  },
  "what_to_do": {
    "if_received": [
      "Do not call the number, do not reply, delete the email",
      "If you do have a Best Buy account, check it by typing bestbuy.com yourself — never through the email",
      "Nothing was charged; the invoice does not exist"
    ],
    "if_called_or_paid": [
      "Gave remote access? Disconnect from the internet, uninstall the tool they had you install, change passwords from another device",
      "Paid by card or bank transfer? Call your bank now and dispute it. Gift cards? Call the card issuer with the card numbers",
      "Expect a call-back from a \"refund department\" — that is act two of the same scam. Hang up"
    ],
    "report_links": [
      {
        "label": "Report to the FTC",
        "url": "https://reportfraud.ftc.gov/"
      },
      {
        "label": "Report to FBI IC3",
        "url": "https://www.ic3.gov/"
      }
    ]
  },
  "malware_family": null,
  "timeline": [
    {
      "date": "2021-07-11",
      "type": "specimen",
      "title": "Specimen №1: the renewal invoice with a helpline number",
      "text": "The 2021 guide documented the first wave: an invoice-style email with an amount \"charged\", an invoice number and a phone number to dispute it; some copies linked to a fake sign-in page. The screenshot from that guide is the first specimen on record.",
      "added": [],
      "removed": [],
      "sources": [
        "https://soft2secure.com/knowledgebase/geek-squad-scam"
      ]
    },
    {
      "date": "2026-09-02",
      "type": "registry",
      "title": "Family created",
      "text": "Grew out of the 2021 guide \"Geek Squad scam 2021 – how to identify and stay safe\", which stays online unchanged.",
      "added": [],
      "removed": [],
      "sources": []
    }
  ],
  "related": [
    "norton-renewal-invoice",
    "mcafee-renewal-invoice",
    "paypal-invoice",
    "amazon-order-callback"
  ],
  "sources": [
    "https://soft2secure.com/knowledgebase/geek-squad-scam"
  ],
  "legacy_urls": [
    "/knowledgebase/geek-squad-scam"
  ],
  "legacy_redirect": false,
  "created": "2026-09-02",
  "updated": "2026-09-02",
  "changelog": [
    {
      "date": "2026-09-02",
      "text": "Record created at the registry launch."
    }
  ],
  "url": "https://soft2secure.com/scams/geek-squad-renewal-invoice",
  "licence": "CC BY 4.0",
  "generated": "2026-09-03"
}