Scam email examples: 10 common scam emails and their red flags

1. 1

   Geek Squad renewal

   Subject: Your Geek Squad Protection has renewed. "Thank you for renewing. $399.99 will be charged to your account within 24 hours. To cancel, call our billing desk at 1-555-010-3381."

   • Red flags: A charge you don't recognize, a 24-hour deadline, a phone number to cancel. The FTC names Geek Squad in its warnings about these.
   • Learn more: Geek Squad email scam
2. 2

   Norton or McAfee renewal

   Subject: Subscription renewed successfully, Order #NR-82614. "Your Norton 360 Total Protection (5 devices) has been auto-renewed for $289.99. If you did not authorize this, contact us at 1-555-010-5512."

   • Red flags: An order number to look official, a big charge, and a number to call. Check your card statement instead.
   • Learn more: Norton renewal email scam
3. 3

   PayPal invoice

   Subject: You've received an invoice. "Invoice for $648.00 (Bitcoin purchase). If you did not make this purchase, please call PayPal Support at 1-555-010-6620."

   • Red flags: An invoice you never requested, a phone number written into the invoice notes. Log in to PayPal yourself to check.
   • Learn more: PayPal invoice scam
4. 4

   Amazon order confirmation

   Subject: Your order of Apple MacBook Air has shipped. "Order total: $1,249.00. If you didn't place this order, call our fraud team immediately at 1-555-010-8890."

   • Red flags: An order you didn't place and a phone number. The FTC says to check orders by logging in to Amazon yourself.
   • Learn more: Amazon impersonation scam
5. 5

   Streaming payment problem

   Subject: Your account is on hold. "Dear Customer, we couldn't process your payment. Update your billing details within 48 hours to avoid cancellation. [Update Payment]"

   • Red flags: Generic greeting, a payment problem, a link to update your card. The FTC says real companies don't email links to update payment info.
   • Learn more: How to spot a phishing email
6. 6

   Bank account locked

   Subject: Unusual sign-in activity: account restricted. "We detected a sign-in from a new device. For your security, access is restricted. Verify your identity here to restore access."

   • Red flags: A login you didn't make, a link to "verify." The FTC lists fake suspicious-login alerts as a common phishing story.
   • Learn more: Bank impersonation scam
7. 7

   Party invitation

   Subject: You're invited!. "Susan has invited you to a celebration. Click below to view the invitation and RSVP. [View Invitation]"

   • Red flags: The FTC warns that fake invitations can look like they come from friends or family. Check with the person on a separate text or email.
   • Learn more: How to tell if an email is a scam
8. 8

   IRS refund

   Subject: Tax refund notification. "After the last annual calculation, you are eligible to receive a refund of $1,186.50. Please submit the form to process your refund."

   • Red flags: The IRS says it normally contacts you first by mail, and only emails if you opted in. A refund form to fill in is a trick to get your details.
   • Learn more: IRS scam
9. 9

   Social Security suspension

   Subject: Urgent: your Social Security number has been suspended. "Due to suspicious activity, your SSN is suspended. Call the Office of the Inspector General at 1-555-010-4012 today to avoid legal action."

   • Red flags: SSA says scammers claim your number will be suspended unless you act now. Real SSA employees won't demand immediate payment or threaten arrest.
   • Learn more: Social Security scam
10. 10

    Prize notification

    Subject: Official winner notification. "You have been selected to receive $1,500,000. To release your funds, a one-time processing fee of $250 is required."

    • Red flags: You didn't enter, and you must pay to collect. The FTC says, "If you have to pay to get your prize, it's a scam."
    • Learn more: Sweepstakes and lottery scam

About these examples

Every example on this page is illustrative. We wrote them from patterns described by the FTC, FBI and other official sources. Phone numbers use the fictional 555 range and web addresses end in ".example". Real scam links look like ordinary web addresses, often with extra words or odd endings.

Two kinds of scam email

Click scams want you to tap a link and type something: a password, card number, or personal details. Examples 5 to 8 work this way.

Call scams want you to phone them. Examples 1 to 4 and 9 work this way. They often have no link at all, which is why some filters miss them. The FTC says the "refund agent" on the phone may ask for remote access to your computer and your bank details.

Quick checks for any email

• Do I have an account with this company? If not, it's likely phishing.
• Is the charge on my real statement? If not, it's a scam.
• Does the sender's address match the company? In Gmail, click the Down arrow under the sender's name to check.
• Is there a phone number to call? Use the number on your card instead.

Questions people ask