Sheftali's Unknown

Mail filters hunt for links. The Geek Squad invoice scam email gives them nothing to hunt: no link, no login page, just a bill and a phone number. A number is plain text, so the message sails past scanners and lands looking like routine billing. The caller does the real work later. Here is how the trick runs, what it has cost, and the one check that ends it.

Why does a Geek Squad invoice scam email carry no link?

A link is the one thing a mail filter can scan and block, so the scam hides its payload in a phone number, which reads as harmless text and only turns dangerous when you dial it.

Researchers Joshua Long and Kirk McElhearn documented the mechanism at Intego in April 2023. The emails came from a sender named "Intuit E-Commerce Service", relayed through Intuit's own invoicing servers, which spam filters tend to trust. The subject read like a receipt for a three-year Totaltech renewal. So "it came from a real invoicing service" proves nothing, and the standard advice to inspect the sender address no longer settles it. That advice is outdated for this scam. The pattern echoes a toll-text scam that gates its link behind a reply and a fake renewal invoice with an extra-zero refund trap.

The FBI's Internet Crime Complaint Center shows the scale. Its 2024 report logged 36,002 tech and customer-support complaints and $1.46 billion lost. Its 2025 report logged 47,794 and $2.13 billion. Complaints rose 32.8% while losses rose 45.7%, so the average case got costlier, not just more common. Neither report states that comparison; we derived it by setting the two side by side.

Four numbers decide how seriously to take this. The FTC's October 2022 alert supplies the clock, and IC3's 2025 report supplies the rest, with two of them derived by dividing its totals rather than read off a page.

The deadline matters more than the money. A message that demands a call within a day exists to stop you doing the one slow, boring thing that would expose it: opening your own account. Urgency is the product being sold.

Is a Geek Squad invoice email real?

Not on the evidence in the email itself: an invoice proves nothing about whether a charge exists, because anyone can send one through a trusted billing service, so proof has to come from somewhere the sender does not control.

The table sorts the situations by what you have already done. Find your row; the last column carries the fact that decides it. Where a rule comes from the FTC, the row says so.

The common thread is order. The scam needs you to act before you look, so every row puts a look at your own accounts first. The repay row costs real money, and older people meet it more often than their numbers suggest.

Decision: whether an older relative needs this check set up for them before the call comes, since the outer ring shows their share of dollars lost outrunning their share of complaints. Derived by dividing IC3's 2025 age-group totals for people over 60 by its tech and customer-support totals.

Worked example: suppose the email claims a $300 renewal, and the caller says a $5,000 refund landed by mistake. Both figures are illustrative assumptions, not sourced numbers. Repay demanded: $5,000 minus $300 is $4,700. Now open your bank app, a one-minute check that is yours alone to make. If nothing landed, you are asked to send $4,700 against $0 received, so paying costs exactly $4,700. Move the sliders to the three figures in your own situation.

Why did I get an invoice for something I never bought?

Because the sender does not need you to be a customer: a bulk invoice only has to reach the few people who own a plan or fear one lapsed, and everyone else is free noise.

The FTC's alert lays out the escalation. After the call can come a request for remote access, then a story that you were "accidentally refunded too much", then a demand to repay with gift cards. Each step makes the last one harder to walk away from, which is why the first call is the one to skip.

Reports from people over 60 rose 27.2% on 2024 while their losses rose only 5.9%, so the average hit per report fell, though at $48,785 it still sits about 9% above the all-age average. Our opinion, not a finding: IC3 counts only those who file, and we suspect embarrassment keeps many victims out of the totals. Report the message at ReportFraud.ftc.gov. Delete it, or rather report it first, then delete it.

• A valid software signature says who built the support tool, not who is holding it. Intego's caller steered its author to an app signed by ConnectWise.
• A callback number that changes mid-call is a warning. Intego's follow-up number routed to a TextNow voicemail.
• The same trick works by phone: a fake bank fraud call can show your real bank's number, so a familiar caller ID settles nothing.

This week, type the Best Buy address into your browser yourself, sign in to your own Best Buy account, read the plans and charges it lists, and treat the invoice as unproven until they match. Then walk the relative who would pick up that phone through the same two minutes. One limit: this checks the charge, not your bank, so if you already paid or gave screen access, call the number on the back of your card.

The first payout is real. That is the trick. A task scam pays you a few genuine dollars for clicking through fake "app optimization" or "product boosting" work, so that when the app later asks for a deposit to unlock the next set of tasks, it feels like an advance on money already earned. Think of that payout as the scammer's marketing budget. The deposit is the sale.

How do task scams work?

The scheme hires you for fake app work, pays small real amounts for the first easy tasks, then demands your own money, usually crypto, before the next set of tasks or your earnings unlock.

It starts with an unsolicited text or WhatsApp message about online work that names no company you could check. The "job" is tapping a button that supposedly rates products, inside a slick dashboard with a balance and a cheerful "mentor" in the chat. The FTC says paying people to rate or "like" things online is illegal, so the job itself is a red flag before any money moves.

Then the money arrives. Small, real, withdrawable. That payout turns suspicion into a story you tell yourself: they paid me, so they must be paying. The standard advice is to research the company, and I think it is out of date here. These apps borrow real brand names, the same way the safe account scam borrows your bank's real phone number, so a company that checks out tells you nothing about who is messaging you.

Partway through a set, the app says you must top up to finish it, usually in crypto. That payment rail is the giveaway. A March 2025 FTC release found people lost more to scams paid by bank transfer or cryptocurrency than to all other payment methods combined, which is also why a fake dealership website insists on a wire: scammers pick the payment you cannot claw back.

Four FTC numbers, from its December 2024 Data Spotlight and its March 2025 fraud release, show why the damage lands at the deposit stage.

Spread the half-year loss across the roughly 51,000 job-scam reports implied by the FTC's own share figures, and it comes to about $4,300 per report, counting everyone who lost nothing. That is derived arithmetic, not an FTC statistic, but it prices the deposit stage in thousands, against the handful the app paid you first.

A polished app settles nothing. What matters is which stage of the script you are in.

Why do I have to deposit money to unlock tasks?

You are asked to deposit because the deposit is the scam's only product: the tasks are fake, the balance is a number on a screen, and every early payout existed to make this one request feel safe.

Here is a one-minute check. Add up every dollar the app has actually paid into your bank, not the balance it displays, and put the deposit it wants beside that total. If the deposit is bigger, and sooner or later it must be or the scheme loses money, you are funding your own wages plus the scammer's margin. Call it the payout test. Then find your stage below and read across.

No row says "finish the set first." That urge to win back your money is the lever the next deposit pulls.

Can I get my money back?

Usually not: crypto sent to a scammer has no chargeback, so recovery depends on reporting it fast and on ignoring anyone who later offers to get it back for a fee.

Your exchange may freeze a receiving account if you tell it quickly, but nobody can promise a reversal. Report at ReportFraud.ftc.gov and the FBI's IC3 site anyway. The scheme needs you to answer at all, the same opening move as the toll text that asks you to reply Y.

The second wave is the dangerous one. Lose money once and "recovery agents" offering to trace your coins for an upfront fee start calling, running the same play twice, like the refund trap inside the renewal invoice scam. The pool keeps growing: the FTC told Congress in March 2026 that consumers reported $15.9 billion in fraud losses across 3 million reports in 2025, so anyone who paid once should expect a follow-up pitch. Here's the grey area, in my opinion: the platforms that turn a victim's cash into crypto should share that loss, and whether they ever will is an open question, probably a long one.

• A balance that grows but cannot be withdrawn without a "fee" or "tax".
• An instruction to move the chat from text to WhatsApp or Telegram.
• A recovery service that contacts you first and wants payment upfront.
• Any request to pay in crypto or through a crypto ATM.

The payout comes first because it is the cost of selling you the deposit, so the one rule that breaks the whole scheme is to never pay anyone to get paid. This week, before you open that app again, total what it has truly paid into your bank, send nothing more, and file the chat at ReportFraud.ftc.gov.

The number on your screen is the one printed on the back of your card. That does not mean your bank is calling. Caller ID is a label the caller's own system attaches to the call, and it can be set to almost any number, which is the whole trick behind the safe account scam: borrow the real number, then say the account is under attack.

How the safe account scam borrows your bank's number

The scammer sets the caller ID to your bank's real number, usually copied from the back of your card, so the display matches while the voice belongs to a stranger who wants your money moved.

The FBI's warning, as summarised by security firm Bitdefender in May 2026, lays out the sequence. After the spoofed number comes your account number and balance, pulled from breaches, phishing or malware, or from abusing automated balance-check lines. Then the claim that staff are illegally inside your account, and the offer of a fix: send the money to a "safe" account, which belongs to the criminals, by Zelle or transfer. Every step answers the question you were about to ask: is this my bank?

The FTC's June 2026 release puts business impersonators at nearly $1 billion in 2025 losses, up from $866 million in 2024, and says bank impersonators carry the highest losses among them. That makes the bank impersonation scam worth a rule of its own.

Fake auto-renewal charges that list a phone number and a fake dealership website that insists on a wire work the same way: they move you onto a channel the scammer controls.

Four figures decide how worried to be. The first two come from that FTC release: dollars lost to imposters in 2025, and how many people reported one. The third is my own division of the first by the FTC's all-fraud total of $15.9 billion (March 2026 testimony to Congress), a figure roughly a quarter above 2024, so "it won't be me" is the wrong assumption.

The call-length figure is the odd one out: the person who stayed on that long, in the report Bitdefender summarised, still caught a disguised dollar amount at the final Zelle screen, so the last confirmation is a real checkpoint. The script exists to keep you talking until your thumb is already moving.

Is a call from my bank's fraud department ever real?

Yes, banks do call about suspicious activity, but a real fraud team never needs you to transfer funds, so any caller who tells you to move money to a safe account is running the scam, whatever the display says.

The FTC says it will never demand money or tell you to transfer money, so an official who does is, by definition, not the agency.

A scammer can copy the number on screen and the balance they recite, but not the request. Judge what is asked, never who appears to be asking.

Only the last of the four stages is yours to stop, so the decision to refuse is made before the call, not during it. Stages follow the FBI sequence as relayed by Bitdefender; the zeros and the one are my count of what you control.

Will my bank refund me if I sent the money myself?

Often not: refund rules mostly cover transfers you did not authorise, and a payment you approved while deceived is usually treated as authorised, so recovery can depend on the bank's goodwill and on how fast you report it.

In the report Bitdefender summarised, a Huntington customer sent $5,000 and reportedly got nothing back because she had approved it herself, while a Chase customer's roughly $40,000 was gone by the next day. Your approval becomes the bank's argument, so call the real number first and gather proof second.

The FTC's June 2026 release counts a dozen actions and more than $70 million in redress tied to its 2024 Impersonation Rule, roughly two cents on the dollar against a single year of imposter losses. My arithmetic, and a loose one since the actions span years, but the money mostly does not come back.

My view, and it is only a view: the standard advice to stay vigilant puts the burden on the one person in the conversation who cannot verify anything. I agree with banks on "hang up and call back", not on burying it in the small print. Never act on an inbound call about money (banks do ring first sometimes, which is why you judge the request), because the display is the one thing the caller controls. The same instinct breaks the unpaid toll text scam, where the message asks you to reply Y before the link works: step out of the channel the sender chose.

• Redial from a different phone, because a line you thought you ended can stay connected to the caller.
• Ignore any number the caller offers "to verify"; use the one on your card or in your bank's app.
• Read the final confirmation screen slowly; stop if the amount or recipient is off.

This week, copy your bank's fraud line from the back of your card into your phone, and settle now that any call asking you to move money ends with you hanging up and dialling that saved number. One redial breaks the script.

Related: task scam that pays you first, then asks for a crypto deposit