Shopping / phishingEmailPhone
Fake subscription renewal and invoice emails
Last updated
Also known as: Fake Geek Squad renewal invoice, Fake PayPal invoice, "Your membership has expired" payment email
What it looks like
Emails made to look like they come from a business you know, often with its logo, say your subscription or membership has expired and ask you to click a link to enter payment details, sometimes with a discount for updating now. Other versions say a subscription has auto-renewed for a set amount (one Geek Squad-branded email claimed $488) and give a "customer service" number to cancel. The person who answers may offer a refund or ask for your bank account details, which can let scammers take money from your account. According to BBB, PayPal was the organization most often impersonated in reports to BBB in 2025.
Who it targets
Consumers with subscriptions or memberships, and small businesses that pay invoices.
Red flags
- Urgent email saying your subscription expired or auto-renewed for a large charge you don't recognize
- Link asking you to update or "insert" card details, sometimes with a special deal for acting now
- A phone number in the email or attached PDF invoice to call to cancel the charge
- Sender address that doesn't look like the real company, plus scare tactics or spelling errors
- Request to pay or confirm with a bank account number, prepaid cards, digital wallet apps, or a wire transfer
What to do if you clicked, paid, or replied
- Don't click links or call phone numbers in the email
- Log in to your account directly or call the business's real number from its official website to check
- Keep a calendar of your subscription renewal dates and expected charges so fake notices stand out
- Don't give payment details for a purchase you didn't start, even if the message threatens late fees or legal action
- Look up and report the email at BBB Scam Tracker, then mark it as spam and delete it
Still circulating?
BBB repeated its warning about fake invoice and subscription renewal scams on October 13, 2026, as reported by KY3.
Related sources
Educational summary only. Verify details on the source page. Report fraud at ReportFraud.ftc.gov or ic3.gov.