The fake renewal invoice: anatomy of the scam

By MercPrivacy · Published 2026-06-21 · Updated 2026-08-05

The invoice for an antivirus renewal you never bought has no links to click. The payload is the phone number — and the scam starts when you dial it. How the play works and what to do if you called.

The email says thank you for your purchase. Your antivirus subscription — or streaming plan, or computer support package — has renewed for several hundred dollars, charged to a card ending in digits you do not recognize, and if you have questions about this charge, please call the number below.

You have questions. That is the point. You did not buy anything, no card was actually charged, and the entire document is a prop. The invoice is not the record of a transaction; it is a script engineered to produce one specific behavior: you, on the phone, rattled, with your bank information within reach.

This scam family is worth understanding in detail because it inverts the standard advice. Everyone has been trained not to click strange links. This email often contains no links at all. The payload is a phone number, and the danger begins when you dial it.

## Why the invoice is clean

Spam filters are good at catching links and attachments that lead bad places. They are much worse at a plain, politely formatted invoice that asks for nothing — no click, no login, no download. That is deliberate. The message is built to slide through filtering precisely by containing nothing technically malicious.

The tells are in the details instead:

- **A charge you never made**, for a product you may not even use, from a sender address that has nothing to do with the brand printed on the invoice. - **Urgency with a deadline** — the charge posts today, the renewal becomes final within a day, call now to cancel. - **A phone number as the only remedy.** Real subscription businesses handle cancellations in your account settings. They do not route refunds through a callback line printed on an attachment. - **Authentication that fails.** The display name says a company you know; the headers usually say otherwise. Pull them once — [here is how](https://mercprivacy.com/knowledge/how-to-find-email-headers) — and the costume falls apart.

The genre has cousins aimed at businesses — the payroll-diversion note, the vendor bank-change request — but the household version is the renewal invoice, and the mechanics are the same: a plausible document, a manufactured deadline, and a human on the other end of a phone line.

Federal law requires commercial email to use truthful headers and subject lines, but the people running this play are not marketers cutting corners; they are running fraud. The interesting question is not whether the email was lawful. It is what happens on the call.

## What happens if you call

The person who answers is friendly, apologetic, and eager to refund you. The refund requires access or information — and that is the trap. The common branches:

1. **Remote access** — to "process the refund," they walk you through installing remote-control software. Now they are inside your computer, where saved passwords, open banking sessions and files live. 2. **The overpayment routine** — they "accidentally" refund too much, show you a doctored screen that appears to prove it, and ask you to return the difference by wire, gift cards or a payment app. The original refund never existed. Your repayment is the theft. 3. **Verification harvesting** — a card number to "locate the charge," a bank login to "confirm the account," a one-time code that is actually the key to taking over an account. Each item is the scam by itself.

> The email is bait, the invoice is a prop, and the phone number is the whole scam.

## If you already called

No shame in it — the script is polished by sheer volume of rehearsal. What matters now is speed and order.

1. **If you gave card or bank details**, call your bank or card issuer immediately, using the number on the back of the card. Report the activity as fraud and ask about replacing the card and credentials. 2. **If you granted remote access**, disconnect the machine from the internet, uninstall the remote software, and change important passwords from a different device. Assume anything saved in the browser was readable. 3. **If money moved**, ask the bank about recalling or disputing it right away. Wires and gift card codes are the hardest to claw back — which is exactly why they asked for those. Fast beats perfect. 4. **File at [identitytheft.gov](https://identitytheft.gov)** if personal or financial information was taken. It generates a recovery plan and the documentation banks and bureaus recognize. The FTC's consumer site at [consumer.ftc.gov](https://consumer.ftc.gov) also keeps current guidance on this scam family as it mutates. 5. **Consider freezing your credit.** Freezes are free at all three bureaus, and free weekly reports at [annualcreditreport.com](https://annualcreditreport.com) let you watch for accounts you did not open.

## Keep the email

Deleting the message feels like hygiene. Keep it instead — the original file, headers and all, per [the evidence-file discipline](https://mercprivacy.com/knowledge/the-evidence-file-what-to-keep). If money was lost, your bank and law enforcement will want the artifact, not your memory of it. And if your address keeps drawing this genre, the preserved set documents a pattern: forged sender identities are precisely the falsity that gives several state email laws their teeth.

One more habit worth keeping: when an invoice scare lands, check the claimed account directly by typing the company's website into your browser yourself. Thirty seconds looking at your actual subscriptions answers the question the scammer wants you to ask them instead.

## Where we fit

If your inbox has become a steady drip of fake renewals and you want to know whether any of it is actionable — or you simply want the flood slowed by shrinking where your address circulates — [Stephanie](https://mercprivacy.com/stephanie) answers instantly and free, and (830) 587-5011 reaches us directly. We are not a law firm; when a matter requires legal representation, a licensed attorney is engaged.