Geek Squad scam emails: the fake renewal invoice, and how to check it
An email says you will be charged hundreds of dollars to renew Geek Squad and gives a number to call. Here is what happens if you call, how to check the charge safely with Best Buy, the same trick dressed as McAfee or Norton, and what to do if you already called.
The email
It looks like a receipt. There is a Geek Squad logo, an order number, and a charge of a few hundred dollars for a membership "renewal" you don't remember buying. Near the bottom is a phone number: call within 24 hours if you want to cancel.
The FTC describes it the same way: a text or email "that says you were or will be charged hundreds of dollars to renew your Geek Squad membership", and a phone number you "must call … within 24 hours" to dispute it or cancel (FTC).
The email doesn't take your money. The phone call does.
What happens if you call
The person who answers is the scammer. The FTC describes two ways the call usually goes (FTC):
- "Let me connect to your computer to process the refund." If you allow remote access, "they can install spyware programs on your computer, steal your online banking credentials, and drain money from your bank account."
- The fake overpayment. They ask for your bank details to "refund" you, then "fake a transaction and make it look like they accidentally refunded you too much." To pay back the difference, they tell you to buy gift cards and read them the numbers and PINs.
A real refund does not need control of your computer, and no real refund ends with you buying gift cards.
How to check whether the charge is real
Don't use anything in the email: not the phone number, not the links, not the attached invoice.
- Check your own bank and card statements. If nothing was charged, there is nothing to cancel.
- Contact Best Buy through a door you open yourself. Best Buy's own advice is to "call us at 1-888-BEST BUY (1-888-237-8289) or use a contact method found directly on BestBuy.com" (Best Buy). If you have a Best Buy account, sign in at bestbuy.com by typing the address yourself, and check your orders and memberships there.
- Read the sender's address. A real Best Buy email should come from Best Buy's own domain. A free mailbox, or a random name at an unrelated domain, is a fake. Our guide to telling whether an email is a scam walks through this and five other checks.
Best Buy also says "we generally don't make unsolicited calls to customers", so an unexpected call "from Best Buy or Geek Squad" deserves the same suspicion as the email (Best Buy).
The same email, in other costumes
Fake renewal emails are not only sent in Geek Squad's name. Security brands are a favorite costume, and both McAfee and Norton keep an address for fakes that use their name. If you get one, the checks above work the same way:
- McAfee: "Forward suspicious emails to [email protected]" (McAfee).
- Norton: forward it to [email protected]. Norton prefers the email as an attachment, "to avoid the loss of key content of the message which is required for analysis" (Norton).
How to report it
- To Best Buy: "If you suspect a scam regarding an offer from Best Buy or Geek Squad, please report it by emailing us at [email protected]" (Best Buy).
- To the FTC: at reportfraud.ftc.gov.
- To your email provider: use its "Report phishing" button. Here are the steps for Outlook, Gmail and iPhone Mail.
If you already called
- You let them onto your computer: disconnect it from the internet. From a different device, change your email and banking passwords, then have the computer checked before you use it for banking again.
- You gave bank or card details: call your bank or card issuer now, using the number on the back of your card. The FTC's advice is to check your accounts for charges you didn't make and report them to your bank straight away (FTC).
- You bought gift cards for them: "Report the gift card scam to the gift card company right away," and "always keep a copy of the gift card and store receipt" (FTC). The FTC says some card companies "might give your money back". Ask.
Then report it to the FTC. If someone later offers to recover your money for a fee, that is a second scam aimed at people who have already lost money (FTC).
Check a link before you click it
If the email you got has a "cancel your subscription" link instead of a phone number, the same rule applies: don't open it to find out. Best Buy's own advice is that "URL-checker software and other security applications can help protect against malicious links" (Best Buy). That is what our checker does. Paste the link, and we open it in a browser that is not yours and tell you where it really ends and what it asks for.
Check a link before you click it
Paste the link or scan the QR code. We open it for you and show the real destination, the redirects on the way, and whether anyone has reported the seller behind it.
Check a linkMore articles
- QR codes Quishing: how QR code scams work, and how to check a code before you scan it Quishing is phishing through a QR code: on a parking meter, in an email, on a flyer or a package you never ordered. How each version works, what the FTC and FBI advise, and how to see where a code goes first.
- Scams How to report a phishing email in Outlook, Gmail and iPhone Mail The exact buttons to report a phishing email in Outlook, Gmail and Apple Mail, where else to forward it (APWG, the company being faked, the FTC), and what reporting does and does not do.
- Scams Venmo scams: the tricks Venmo itself warns about, and the one tap that keeps you covered The "sent it by mistake" payment, the fake Venmo Support call, the fake purchase and the lookalike friend. How each Venmo scam works, what Venmo says it will never do, and when Purchase Protection can get your money back.
