The Geek Squad “renewal” email scam: don’t call that number

Home › Blog › The Geek Squad renewal email scam

Published 23 July 2026 · ~7 min read · By the Phixo team

Geek Squad is Best Buy’s tech-support and protection-plan brand, which makes it perfect raw material for a scam: millions of people have genuinely paid for a Geek Squad plan at some point, and everyone else can be made to panic about a charge they never approved. The fake renewal email plays both crowds at once — and it has become common enough that consumer-protection agencies, including the US FTC, have published warnings about this exact email.

What makes it unusually slippery is what it doesn’t have. Most phishing advice says “check the link before you click.” This email often has no link at all — nothing for a spam filter to blacklist, nothing for your hover-instinct to catch. The entire attack is a phone number. Security folks call the pattern callback phishing, or TOAD (telephone-oriented attack delivery). You call them, which feels safe — and that’s the trick.

The quick answer

If you never had a Geek Squad subscription, the email is a scam — full stop. You will not be charged; the scammers don’t have your card. If you do have (or once had) a plan, still don’t call the number in the email. Check your card statement for an actual charge and manage the plan by logging in to your Best Buy account directly. A real renewal notice never requires an urgent phone call to stop a charge; the “cancel by phone within 24 hours” pressure is the fingerprint of the scam.

How the scam actually works

The email is only act one. Here’s the full play:

1. The bait: a renewal receipt or invoice — typically $299 to $499 — saying the charge will hit your account within hours. Sometimes the “invoice” is a PDF attachment and the email body is nearly empty; the phone number is inside the PDF, which helps the message slide past filters.
2. The call: a calm, helpful “billing agent” agrees the charge must be a mistake and offers to cancel and refund it. You called them, so your guard is down.
3. The hook: to “process the refund” they need you to install remote-access software, or log in to your bank while they’re connected, or read out your card number. A favorite script fakes an over-refund — “oh no, we sent you $4,000 instead of $400” — complete with a doctored bank screen, then pressures you to wire back the difference or buy gift cards to fix “their mistake.”

5 tells of the fake Geek Squad email

1. You don’t have a Geek Squad subscription

The most obvious tell, and still worth saying: a renewal receipt for a service you never bought is not a billing error — it’s bait. Scammers blast these to millions of addresses knowing most recipients have no plan; the email counts on panic doing the rest.

2. The sender isn’t a bestbuy.com address

Tap or click the sender name to reveal the full address and read the part after the @. Best Buy owns bestbuy.com; its real emails come from bestbuy.com or subdomains of it. The fakes come from random Gmail or Outlook addresses, or from invented domains that merely contain the words.

That second pattern — a big brand “billing department” writing from a free Gmail address — is on its own enough to close the email.

3. The only way to cancel is a phone number

Real subscription emails link you to your account to manage or cancel the plan. An email that offers no self-service option and funnels everything to an urgent phone call is following the callback-phishing script. The absence of links isn’t reassuring — here, it’s the tell.

4. A charge that isn’t on your statement

The email says $399.99 “has been debited” or “will be debited within 24 hours.” Your card statement is the ground truth, and checking it takes one minute in your banking app. No matching charge means no charge exists — the number in the email is theater.

5. Generic greeting, urgent clock

“Dear Customer” plus a 24-hour countdown is the classic pressure pairing. A company that just billed you knows your name — and a real receipt doesn’t race you against a deadline, because a real charge has already happened or hasn’t.

Why this one beats link-checking instincts

If you’ve read our guide to the 8 warning signs of a phishing email, you already hover over links and read sender domains. Callback scams are built to route around exactly those habits: no link to hover, and often a throwaway Gmail sender that doesn’t even pretend to be spoofed. The same play powers the fake Amazon order-confirmation call-back and a whole family of fake invoice emails — a believable bill plus a number designed to get you on the phone, where there’s no URL bar, no padlock, and no record of what was said.

This is also why we built the callback pattern into Phixo’s detection directly: it flags a known tech-support brand combined with renewal language and a callback number, and it treats “charge language plus a phone number plus no link at all” as a red flag in its own right — because legitimate renewal emails always give you a link to manage the plan.

What to do with a fake Geek Squad email

1. Don’t call the number — and don’t open the attachment if there is one.
2. Report it: use “Report phishing” in Gmail or Outlook. In the US you can also file at reportfraud.ftc.gov.
3. Delete it, so you don’t revisit it in a weaker moment.
4. If you’re genuinely unsure whether you have a plan, log in to your Best Buy account directly or check your card statement — never through anything in the email.

What if you already called — or let them in?

Take a breath; recovery is very doable if you move now, in this order:

1. Hang up, and don’t answer follow-up calls from that number. Scammers re-dial “to finish your refund.”
2. If you installed anything (AnyDesk, TeamViewer, UltraViewer, “support tool”): disconnect the computer from the internet, uninstall the program, restart, and run a malware scan before using the machine for anything sensitive.
3. If they saw your bank or you read out a card number: call your bank or card issuer now — the number on the back of your card — and tell them exactly what happened. They can freeze the card and watch or reverse transfers.
4. If you paid by gift card or wire: report it to the gift-card company and your bank immediately — speed matters more than anything else here — and file at reportfraud.ftc.gov.
5. Change passwords from a different, clean device for any account you touched while they were connected — starting with your email and bank. Our step-by-step recovery guide walks through the full checklist calmly.

Frequently asked questions

I never had a Geek Squad subscription — will I actually be charged?

No. The scammers don’t have your card; the “charge” is invented to make you call. Check your card statement if you want certainty — no matching charge means nothing happened. There is nothing to cancel, and no one to call.

What happens if I call the number?

A convincing “agent” offers to cancel and refund the charge, then needs you to install remote-access software, log in to your bank while they watch, or read out card details to “process the refund.” A common variant fakes an over-refund and pressures you to send the difference back by wire or gift cards. Hang up at any point — nothing legitimate happens on that call.

How can I tell a real Best Buy email from the scam?

Real Best Buy emails come from bestbuy.com addresses (or subdomains of bestbuy.com) and let you manage any plan through your online account. A random Gmail sender, a lookalike domain, an invoice-in-a-PDF, or “cancel by phone within 24 hours” each mark it as fake. If you want to see the technical trail, our free email header analyzer shows where a message really came from.

How do I report it?

Hit “Report phishing” in Gmail or Outlook, and in the US file a report at reportfraud.ftc.gov. Then delete the email. If money or access was lost, contact your bank first — then report.

Keep reading

• Is that Amazon "account suspended" email real? — Home of the call-back scam’s other favorite costume.
• How to spot a fake invoice email — The wider family of bills designed to make you panic.
• What to do if you clicked a phishing link — Gave them access or details? Recovery, step by step.
• The best anti-phishing browser extensions — The tools that catch emails like this one, compared side by side.