In this guide 10 sections
At a glance
The short version.
Watch for
- An invoice, order confirmation or renewal notice for a large charge you do not recognise
- A short deadline — often 24 hours — to cancel or dispute before the money is taken
- A phone number as the only way to cancel, with no route through your own account
Already acted?
If you are still on the call, hang up. Do not call back on any number the caller or the email gave you.
See every recovery stepWhat is changing now
The current pattern.
The current pattern is ‘callback’ phishing: a fake invoice, order confirmation or auto-renewal notice with no dangerous link, only a phone number to cancel or dispute a charge of several hundred dollars or euros. Switzerland’s National Cyber Security Centre reported a rise in these messages in late 2025, imitating security-software renewals, payment-service invoices and online shops; US warnings describe the same script. The call leads to remote-access software, a ‘refund’ form that captures card or banking details, or a claimed overpayment that the victim is pressed to send back.
How it works
How the scam unfolds.
The message is built to look like routine paperwork: a receipt for an antivirus or tech-support plan that has ‘auto-renewed’, a payment-service invoice or an online-shop order you never placed. The amount is high enough to alarm, and a short deadline — often 24 hours — leaves little time to think. Many versions contain no link or attachment at all, just a phone number, which helps them slip past filters that look for dangerous links. Some are closely modelled on genuine emails.
The number does not reach customer service; it reaches the scammers’ own call centre. A friendly ‘agent’ offers to cancel the charge, then says the cancellation or refund needs a remote-support app, a refund form or a sign-in to online banking. Remote access lets them watch the screen, capture passwords and move money, and some black out the victim’s screen while security codes are entered. A form that asks for card details so you can ‘receive’ a refund is collecting those details: you do not need to hand over card details to receive money.
Refund versions add a final twist. The caller claims that too much was returned by mistake — pointing to a balance shown while they still control the computer — and asks for the difference back by bank transfer, wire, gift cards, cryptocurrency, a payment app or even cash sent by courier. This is the same overpayment trick used in tech-support scams. Every step depends on you using the contact details the scammer supplied; checking the real account or your statement first breaks the chain.
Warning signs
Reasons to stop and verify.
- An invoice, order confirmation or renewal notice for a large charge you do not recognise
- A short deadline — often 24 hours — to cancel or dispute before the money is taken
- A phone number as the only way to cancel, with no route through your own account
- A request to install an app or remote-support software to process a cancellation or refund
- A ‘refund’ that needs your card number, an online-banking sign-in or a code sent to your phone
- A claim that you were refunded too much, followed by a request to send back the difference
Spot the signs
What it can look like.
Highlighted phrases are warning signs; the numbered notes explain each one.
Shieldwise Billing <shieldwise.billing.desk@quickmail.example1 (warning sign 1)>
Your receipt: Total Protection renewed — $349.992 (warning sign 2)
Dear Customer,
Thank you for choosing Shieldwise. Your 3-year plan for 5 devices has renewed automatically. Invoice no. SW-48211-0927 · Payment: auto-debit.
If you did not authorise this renewal, you have 24 hours to cancel and claim a full refund.3 (warning sign 3) Call our billing desk free on 1-800-555-0147.4 (warning sign 4)
You call the number in the email
AgentI can see that renewal and I can cancel it for you today. I’ll just need you to install our secure support app so I can process the refund.5 (warning sign 5)
AgentThank you. Now please sign in to your online banking6 (warning sign 6) so we can send the $349.99 back to you.
- A brand name on a general mailbox
The address belongs to a general email service, not the company’s own domain. Even a correct-looking sender would not prove the charge: these emails are often copied from genuine ones.
- A large charge you don’t recognise
Several hundred dollars is meant to alarm you into acting. A real charge would appear on your card or bank statement, which you can check without contacting anyone.
- A 24-hour deadline
The time limit pushes you to call before you look at your statement or the real account — the checks that would show whether anything was charged.
- A phone number as the only route
There is no link to sign in and check. The call is the point: it moves you from a message you can verify to a conversation the scammer controls. A free-to-call number says nothing about who answers.
- Remote access for a cancellation
Cancelling a subscription does not need anyone to control your computer. Remote-access software lets the caller see and do whatever they like on your screen.
- Online banking for a ‘refund’
You do not need to sign in to online banking, or hand over card details, to receive a refund. With remote access running, this is the moment passwords are captured and money is moved — sometimes behind a blacked-out screen.
Leave the email and its number alone. Open the real account yourself — through its app or a web address you type — and check your card or bank statement. If no matching charge appears, there is nothing to cancel: report the email and delete it.
Composite example: names, numbers and “.example” addresses are fictional.
Worked example
A realistic pattern, separated into evidence.
This composite example is educational. It does not describe a real person or reproduce a live malicious message.
A ‘dispute team’ that needs your card to refund you
- 01The opening
An email that looks like an invoice from a payment service says £749 has been paid for a new smartphone. The recipient has not bought a phone. There is no link to click, only a number for the ‘dispute team’, so calling feels like the careful choice.
- 02The escalation
The agent quotes the invoice number and promises a full refund. First they ask the caller to install a ‘secure support’ app; then they open a refund form and ask for the card number so the money can be returned. The screen suddenly goes black while a security code arrives by text.
- 03The decision point
The email removed the usual warning sign — a suspicious link — and replaced it with a call the scammer controls. Remote access, a card form for a ‘refund’ and a darkened screen while a code arrives are signs that money is being taken, not returned.
Independent verification
Test the request without using its evidence.
These checks deliberately move the decision away from the person, link, number or account that introduced the request.
- 01
Check the account you already have
Open the company’s app, or type its web address yourself, and look at your orders, subscriptions or billing history. If you have no account with that company, there is nothing for it to renew.
- 02
Read your card or bank statement
Look for a matching transaction in your banking app or statement. If you find a charge you do not recognise, contact the card issuer or bank using the number on your card and ask about reversing it.
- 03
Find contact details independently
Use the number on the company’s official website, in its app or on your card or bank documents — never the one in the email, and not a number from a search advert.
- 04
Treat invoice details as unproven
Logos, invoice numbers, product names and a familiar layout can all be copied from genuine emails. None of them shows that a payment has actually been taken.
Prevention
Make the next attempt harder.
- 01
Know what you actually pay for
Keep a short list of the subscriptions you have and when they renew, or check the subscriptions page in your app store or account settings now and then. An invoice for anything not on the list stands out straight away.
- 02
Turn on payment alerts
Instant notifications from your bank or card app show real charges as they happen, so you can compare any invoice email with your own records in seconds.
- 03
Set a household rule for calls
Agree that nobody installs software, shares a screen or opens online banking for someone they reached through a number in an unexpected message. Official warnings note that these schemes often target older adults, so share the rule with older relatives too.
- 04
Report the message, then delete it
Use your email provider’s report-phishing option. In the UK you can also forward suspicious emails to the National Cyber Security Centre at report@phishing.gov.uk. Deleting the email afterwards means nobody else in the household calls the number later.
If you already acted
Protect access and contact the real provider.
- If you are still on the call, hang up. Do not call back on any number the caller or the email gave you.
- If you installed software or let someone connect, disconnect the device from the internet and use a different trusted device for the next steps.
- Contact your bank or card issuer straight away using the number on your card or in its official app. Tell them about any card details, banking sign-ins, codes or payments you shared or made.
- Change any password you typed or read out during the call, starting with email and banking, and anywhere the same password is reused.
- Remove the remote-access tool and run a full security scan, or ask a trusted technician to check the device before you use it for banking again.
- Keep the email, phone number and payment records, then report it: in England, Wales and Northern Ireland to Report Fraud, in Scotland to Police Scotland on 101, in the US at ReportFraud.ftc.gov and ic3.gov, and elsewhere to your national fraud reporting service.
Common questions
Short answers to real doubts.
I called the number on a fake invoice. What should I do now?
If you only talked and shared nothing, hang up, do not call back and treat any follow-up calls with the same caution. If you gave card or bank details, contact your bank or card issuer straight away on the number on your card. If you installed software or let the caller connect, disconnect the device from the internet and follow the remote-access recovery steps.
Remote-access recovery stepsHow can I tell whether an invoice or renewal email is real?
Not from the email itself: logos, invoice numbers and sender names can all be copied. Sign in to the account through the company’s app or a web address you type, and check your card or bank statement. A genuine order, charge or upcoming renewal should be visible there.
The email has no link or attachment. Does that make it safe to call?
No. Many of these messages leave out links on purpose, which can help them get past spam filters. The phone number is the part that does the harm: it connects you to the people who sent the email.
Is this the same as a tech-support scam?
They are closely related. A tech-support scam usually starts with a frightening warning that your device is infected; this version starts with a bill. Once you call, both tend to follow the same script: remote access, a ‘refund’ and pressure to send money back.
Tech-support and remote-access scamsSources
Official guidance used for this article.
Stop & Verify summarises these sources for general education. Reporting routes and legal protections vary by location.