The Fake Geek Squad Renewal Scam

What is it?

The “Fake Renewal” scam is a mass phishing campaign. Scammers send millions of emails pretending to be from trusted brands like Geek Squad, McAfee, Norton, or PayPal. The email claims that your “annual subscription” has automatically renewed for a large amount (e.g., $399.99), and your bank account will be charged within 24 hours.

How it works (The Teardown)

1. The Phishing Email: You receive an email with a giant, official-looking Best Buy or Geek Squad logo. It states, “Thank you for your business! Your annual Geek Squad Protection Plan has renewed for $399.99.”
2. The Panic Factor: Knowing you didn’t buy this, you panic about losing $400.
3. The Trap: The email says, “If you did not authorize this charge, please call our billing department immediately to cancel: 1-800-XXX-XXXX.”
4. The Phone Call: You dial the number. You are not connected to Best Buy; you are connected to a scammer in a fraudulent call center.
5. The Remote Access: The scammer acts helpful. They say they can process your refund, but they need to connect to your computer to do it securely. They trick you into downloading remote access software (like AnyDesk or TeamViewer).
6. The Theft: Once inside your computer, they ask you to log into your bank. They then manipulate the screen to make it look like they accidentally refunded you $4,000 instead of $400. They beg you to wire the difference back to them so they don’t lose their job.

How to identify this scam

• Check the Sender Email: Look closely at the “From” address. A real Geek Squad email comes from @bestbuy.com. The scam email will come from @gmail.com or a random string of letters.
• The Phone Number: Legitimate large companies rarely put massive “CALL NOW TO CANCEL” phone numbers in their receipts.
• No Charge Exists: If you check your actual bank account or credit card app, you will see that no $399 charge actually exists.

How to avoid it

• Never call the number in the email: If you are worried, look up the company’s official customer service number on Google (make sure it’s the real site, not an ad) and call that instead.
• Never grant remote access: Never let a stranger on the phone take control of your computer. No legitimate company needs to control your mouse to process a refund.
• Trust your bank app: Always verify charges by logging directly into your bank, not by trusting an emailed receipt.

What to do if you are affected

• If you let them on your computer: Unplug your computer from the internet immediately. The scammers might have installed hidden malware or password stealers. You must have the computer professionally wiped by a real local repair shop.
• Call your bank: Alert your bank that your computer was compromised so they can lock your accounts and issue new cards.
• Change passwords: From a different, safe device (like your cell phone), change the passwords to your email and bank accounts immediately.