How to tell if an email is a scam: invoices, receipts and renewals

The scam that works by making you call

The FTC describes emails claiming "you were charged hundreds of dollars to renew your tech support subscription," often using names like Geek Squad, McAfee or Norton. They say you must call within 24 hours to dispute the charge. The person who answers offers a "refund," asks for remote access to your computer, then claims they refunded too much and asks you to send the difference back.

These emails often have no links at all, so link-based warnings don't help. The phone number is the trap.

The 60-second statement test

1. Don't call, click or reply

   Leave the email where it is.

2. Open your real account

   Check your bank or card app, or the company's own app (Amazon, PayPal, Apple). Type the address yourself.

3. Look for the charge

   The FTC says if the charge isn't on your statement, the message is a scam. Delete it.

4. If the charge is there

   Contact the company or your card issuer using a number you know is real, not one from the email.

Five kinds of fake billing emails

• Renewal notices: "Your Norton/McAfee/Geek Squad plan has renewed for $399.99." See Norton renewal scam and Geek Squad email scam.
• Invoices: A PayPal-style invoice you didn't request, with a "call us if you didn't authorize this" note. See PayPal invoice scam.
• Order receipts: "Thanks for your order of an iPhone 17 Pro." Check your Amazon or Apple account directly. See Amazon impersonation scam.
• Subscription problems: "Your payment failed, update your card." The FTC says real companies don't email links to update payment details.
• Refund offers: "You're owed a refund, call to claim." This is the same trick in reverse.

How to check the real sender in Gmail

A display name like "PayPal Billing" means nothing. Anyone can type it. Gmail gives you a few ways to see who really sent a message.

1. Look at the address next to the name

   Gmail shows the sender's email address next to their name if you haven't emailed them before. Check the part after the @. A big company won't bill you from a free personal email account or an odd domain.

2. Click the down arrow under the sender's name

   On a computer, open the email and click the small Down arrow below the sender's name. Gmail says a message is authenticated if you see "Mailed by" or "Signed by" with the sending domain.

3. Watch for a question mark

   Gmail says a question mark next to the sender's name means the message isn't authenticated, so it can't confirm who sent it. Be careful.

4. Notice the word "via"

   If Gmail shows "via" and another website next to the sender, the email was sent through a different domain than the From address. Gmail says if that service is unfamiliar, "the message might be spam."

5. For a deeper look, use Show original

   Next to Reply, click More, then Show original to see the full header. Most people won't need this, but it's useful if you're helping a parent check a tricky one.

Where to forward fakes

• Gmail: More, then Report phishing.
• Fake PayPal emails: [email protected].
• Fake Apple emails: [email protected].
• Fake Amazon emails: [email protected].
• Any scam: ReportFraud.ftc.gov.

Still unsure?

Use our free scam checker. For a parent who gets these often, OwlGuardian scans incoming Gmail and moves fake invoices and renewals to quarantine within seconds, before your parent sees them, then alerts you to decide. It works with Gmail today.

Questions people ask