'You Were Renewed — Call to Cancel' Refund Trap
A receipt for a subscription 'renewal' you didn't authorize provides a number to cancel — calling leads to a refund/remote-access scam.
Think a message like this reached you? You can check it right now.
What this scam is
This is the general form of the antivirus-refund scam: an email or text 'receipt' says a subscription (a service, membership, or software) just renewed for a notable amount, with a phone number to cancel or get a refund. The charge is fake. Calling connects you to scammers who use the refund pretext to gain remote access, collect card/bank details, or run an overpayment trick. The receipt exists only to get you to call.
What it usually looks like
- A 'renewal receipt' for something you didn't buy.
- A prominent phone number to cancel or refund.
- A dollar amount big enough to alarm you.
- A short deadline to dispute.
Common warning signs
- Receipts for subscriptions you don't recognize.
- A phone number as the only 'cancel' path.
- Requests to screen-share or share card/bank details to refund.
- Overpayment/'send the difference' stories.
Example wording scammers use
“Your annual membership renewed for $349.99. To cancel and receive a refund, call our billing team now.”
“Order confirmed. If you didn't authorize this, call 1-8XX within 24 hours to dispute.”
These are illustrative examples written by ScamSplain, not real messages.
What the scammers want
- You to call the scam 'billing' line.
- Remote access, card/bank details, or a returned 'overpayment.'
- To exploit fear of an unknown charge.
What to do
- Do not call numbers on unexpected receipts.
- Verify charges in your real bank/app and the vendor's official account page.
- Never grant remote access or send money for a refund.
- Delete and report.
What to do if you already responded
- Contact your bank/card fraud line.
- Remove any screen-share software and scan your device.
- Report at reportfraud.ftc.gov.