A surprise antivirus renewal email offers a refund by phone

A message may claim that a security subscription has renewed for hundreds of dollars and must be cancelled immediately. The phone number can lead to a scammer who asks to control your computer, shows a fake refund page and then demands repayment of an invented overpayment. The invoice itself is not proof of a charge.

Before you start​

Keep the message but do not call its number, open attachments or install a remote-support tool. Use your bank app or card statement directly, not a screenshot in the email.

Do it step by step​

1. Check whether the claimed transaction actually exists in your card or bank activity, including pending entries. Note the merchant name and date if present.
2. If you do hold a subscription, open the vendor's site or app through your own bookmark and review its billing history there.
3. Contact the vendor using details found independently if the two records disagree. Never read a one-time bank code to someone calling about a refund.
4. If you granted remote access, disconnect the session, remove the remote tool and secure accounts from another trusted device. Contact your bank if financial details were exposed.
5. If an unauthorized charge is real, use the bank's dispute process promptly and retain the invoice, transaction and case reference. Report the fraudulent email.

Check the result​

The official subscription account and bank record should explain any genuine renewal. No matching transaction usually means the claimed charge was fabricated.

If something goes wrong​

A real vendor may send renewal reminders, and a pending card transaction may change state. Resolve that discrepancy through the vendor and bank, never through the message's number.

Know the limit​

A remote-access session can expose more than the billing page. If you installed a tool for the caller, treat it as a device and account security incident as well as a payment question. FTC tech-support scam guide