Fake Subscription Renewal Emails and Calls
An email says your antivirus or streaming subscription renewed for a large amount, and to call if you want to cancel. How fake renewal and callback scams work and how to check your subscriptions.
"Thank you for renewing your annual protection plan. USD 399.99 will be charged to your account today. If you did not authorise this purchase, call our billing department within 24 hours." The email looks like a real invoice, with a logo, an order number and a total. You did not order anything, so you call to cancel. That call is the scam.
How callback scams work
- The fake invoice: an email or text about an expensive renewal, usually for antivirus, computer support, streaming, online shopping or cloud storage.
- No link, just a number: the email avoids links, which filters catch more easily, and gives a phone number instead.
- The call: a friendly "billing agent" offers to cancel and refund.
- The trap: to process the refund, they need you to install a remote access app, log in to your bank, or give card details.
- The theft: often followed by a refund scam: "We refunded too much, please send it back."
- A charge for something you do not recognise.
- A phone number and a short deadline, instead of a link to your account.
- Often sent from a free email address, with a generic greeting.
Do not call the number in the email. Check your subscriptions yourself, through your bank statement, app store or the company's official website.
How to check your subscriptions
- Bank and card statements: look for the charge. Fake invoices usually have no matching transaction.
- App store subscriptions: check the subscriptions section of your phone's app store account.
- The company's own account page: log in through the official website or app you already use.
- The company's official support: find contact details on its official website, not in the email.
If you already called
- Gave card details: call your card issuer to block the card and dispute charges.
- Installed an app or shared your screen: follow what to do after giving a scammer remote access.
- Logged in to your bank while they watched: call your bank immediately.
- Report the email as phishing, and report the scam. See how to report a scam.
Received an unexpected invoice? Paste it into CyberWatch AI Scan for a free check before you call anyone.
Callback scams rely on the same tricks as tech support pop-ups. For the bigger picture of how online scams work, read our complete guide.
Frequently asked questions
Why is there a phone number instead of a link?
Callback scams deliberately avoid links, which email filters catch more easily. They want you to call, so a person can talk you into remote access or payment.
How can I check if I really have a subscription?
Check your bank and card statements, your app store subscriptions, and your account on the company's official website or app. Do not use contact details in the email.
I called and gave my card details. What now?
Call your card issuer using the number on your card to block the card and dispute any charges, and change any passwords you shared.
Sources
- Refund and Recovery Scams, US Federal Trade Commission
- Getting Into and Out of Free Trials, Auto-Renewals, and Negative Option Subscriptions, US Federal Trade Commission
- How To Recognize and Avoid Phishing Scams, US Federal Trade Commission
