Sheftali's Unknown

The pitch runs in a fixed order. Someone picks the window where your SIP looked best, prints its SIP XIRR in large type, then hands over eight funds that "complete the portfolio". In the version that costs you money, every fund is a regular plan, the kind that pays the person across the table out of your yearly charges. The XIRR is real. What it leaves out is the bill.

Why does a SIP XIRR headline hide what eight funds cost?

Because XIRR is calculated after a fund's own charges and only for the window shown, it can look strong while the regular plan's extra commission quietly removes rupees you never see itemised.

XIRR is an annualised rate on dated cash flows, so a SIP that began just before a fall and ended just after a rise prints a splendid number; shift the start date and the same fund prints a poor one. Small repeating charges slip past: the renewal invoice scam works because a repeating amount feels ordinary.

SEBI chose disclosure after the fact. Its circular of 5 November 2024 (SEBI/HO/IMD/PoD1/CIR/P/2024/150, effective 5 December 2024 per Business Standard) makes funds show expenses and half-yearly returns for direct and regular plans separately, because commission cannot be charged to a direct plan. Rules like the auto-renewal disclosure law show the charge before it lands; this one prints it afterwards.

SEBI’s advertisement circular CIR/IMD/DF/23/2017 (as of March 2017) asks for CAGR over 1, 3 and 5 years, a point-to-point result on ₹10,000, and a statement of regular or direct plan. It does not mention SIP returns, so an XIRR headline alone is not that format: ask for the multi-year CAGR of the same scheme and plan beside it. Whether a private deck counts as an advertisement is a grey area; in our view, it should.

AMFI’s August 2026 data, reported by Onmanorama, counts 10.02 crore contributing SIP accounts. SEBI’s investor page (retrieved 1 November 2026) shows a 1.5% regular expense ratio leaving 8.5% of a 10% return, against 9.5% for a 0.5% direct plan. The gap disclosure is about 23 months old, and ₹3.89 lakh is our own sum for a ₹10,000 SIP over 15 years.

A count of accounts is not a count of people: on our reading, one investor running eight SIPs appears as eight. SEBI's example takes the same slice of every rupee in one fund or eight.

How much does the gap cost you on your own SIP?

It costs between roughly ₹0.6 lakh and ₹36 lakh on a ₹10,000 monthly SIP, depending on how many years you hold and how wide your fund's gap is.

Take your holding period and your fund's gap: the regular plan's total recurring expense minus the direct plan's, both in its half-yearly statement. Do that subtraction for one fund now and you have your number in under a minute. The 1.0% column is SEBI's illustrative gap, not a measured average.

Worked example: assume a ₹10,000 SIP paid at the start of each month for 15 years (₹18 lakh paid in), a direct plan earning 12% a year, and a regular plan earning 1.0 point less, 11%. Compounding 180 payments at monthly rates of (1 + r)^(1/12) - 1 gives about ₹47,59,314 in the direct plan and ₹43,70,720 in the regular plan. The difference is ₹3,88,594, or 8.2% of the direct corpus.

Find your years down the side and read across at your gap. Each cell is the rupees lost, in lakh (L), on a ₹10,000 SIP at 12% a year.

The shaded cell is the worked example. One step right adds about ₹1.8 lakh at 15 years; one step down adds roughly ₹6.5 lakh at a 1.0% gap. For a ₹20,000 SIP, double any cell.

Where does the eight-fund pitch break down?

It breaks wherever a fund's extra cost buys nothing you can name, such as holdings that overlap another fund on the list or a performance claim from someone unregistered.

The task scam that pays you a small amount first works because proof arrives before cost; a best-window XIRR is a gentler version. Nothing in the deck is false, or rather, nothing has to be. The window and the plan type are both chosen by whoever is paid if you say yes.

One investor on r/personalfinanceindia wrote in early 2025 of putting over ₹30 lakh into regular-plan SIPs through a broker before learning direct plans exist. Replies split on whether a gap near 1% or a good broker matters more. One post, not a statistic.

Do not borrow a cap as your gap. Since 1 April 2026, SEBI’s mutual fund regulations cap an open-ended equity scheme’s base expense ratio at 2.10% on the first ₹500 crore of assets, per HDFC AMC’s March 2026 notice. It does not say how regular and direct plans share that ceiling, so only your statement gives your gap.

• Overlap: funds in one category can hold the same companies, so a longer list can be one bet paid for twice.
• Registration: SEBI’s January 2025 circular, as summarised by Mondaq, bars unregistered people from promising returns, so ask a reel’s author for a SEBI registration number.

This week, open each fund’s latest half-yearly statement, subtract the direct plan’s total recurring expense from the regular plan’s, and enter that gap in the calculator above. The decision is whether to keep each regular-plan SIP or stop it and restart in the direct plan. Selling units you hold can trigger exit load and tax, so read SEBI’s regular-versus-direct page first. If you would otherwise stop investing, a regular plan you keep beats a direct plan you abandon.

The money arrives first. That is the whole design of a fake check scam: a stranger pays you with a check for more than you are owed, the extra shows in your balance within a day or two, and you are asked to send the difference back. Your bank is not vouching for the check. It is meeting a federal deadline.

Why a fake check scam beats your bank's clock

It works because Regulation CC, the federal funds-availability rule, makes your bank release deposited money on a fixed schedule that often runs out before the bank named on the check admits it will not pay. The FTC's fake check guidance (June 2025) says banks must release deposits quickly, yet fakes "can take weeks to be discovered and untangled." Days against weeks.

The scammer's favourite reassurance, "it's a cashier's check", runs the wrong way. Under 12 CFR 229.10(c), a cashier's, certified or teller's check deposited in person into the payee's account must be available in full the next business day, and by the second if deposited by app or ATM. The type sold to you as safest is the one whose forgery reaches your balance fastest.

The CFPB's threshold rule, in force since 1 July 2025, reset Regulation CC's dollar amounts, and section 229.13 caps exception holds. Together they decide how much of a bad check reaches your hands first. Three figures below are law; the last is our arithmetic.

The cash card matters most. Cash, a wire, gift cards or crypto cannot be pulled back when the check fails, which is why the refund request always names one. It is the logic behind why a fake dealership insists on a wire, and the send-it-back step in the renewal invoice scam's extra-zero refund trap.

Can a check show available and still bounce?

Yes, because available only means the legal deadline for releasing your money has passed, while paid means the bank the check is drawn on has honoured it, and a forged check can come back unpaid long after. That is the flaw in "wait until it clears": many tellers and apps use cleared to mean available.

Holds help less than you would think. The large-deposit exception reaches only deposits above $6,725 a day, so a $3,000 scam check never touches it. Add the five-day safe harbor to the second-day deadline and even a held local check is due by about business day 7, roughly a week and a half on the calendar, give or take a holiday. The Fed's Consumer Compliance Outlook (2024) says these amounts re-index to inflation every five years, so they stand until about July 2030.

Worked example: a stranger books you for a $300 job, mails a $3,000 personal check and asks you to forward the rest to a "supplier". Assumptions: Monday deposit, established account, no exception hold, no returned-item fee. On business day 1 the first slice is spendable; on day 2 the full $3,000 shows. You send $3,000 minus $300, which is $2,700. The check returns unpaid, the bank reverses all $3,000, and the $2,700 comes out of your own money. Loss: $2,700, plus any fee your bank lists. Try your own numbers below.

Find your line and read across: the move, then the rule behind it.

No row makes the money safe to forward: the balance says nothing about the check.

Am I responsible if I deposit a fake check?

Usually, yes: when a deposited check comes back unpaid, your bank reverses the credit and takes back anything you already spent or sent from your account, so the refund you forwarded becomes your debt.

The story changes; the request does not. The FTC's page on fake check scams aimed at small businesses (updated September 2025) says an overpayment followed by a request to refund the balance is still a scam, whoever the payer claims to be. The task scam's small first payout runs the same play with app credits.

Our opinion, not a rule: an app that shows a balance as "available" and says nothing more hands the scammer his best line. Two words beside it, "not yet paid", would do more than another warning email.

• "Cleared" can mean available. Ask whether the issuing bank paid the check.
• A cashier's check deposited by app releases one business day later, still weeks before a forgery may surface.
• Already sent money? Tell your bank at once, then report it at ReportFraud.ftc.gov.

The one rule that breaks it: never send money back out of a check from someone you cannot find again, whatever your balance says. If a stranger's check landed this week, call your bank today and ask: has this item been paid by the bank it is drawn on, or are these funds only available? Until the answer is "paid", it is not yours to forward. Only a payer you know, paying exactly what you are owed, earns an exception.

Mail filters hunt for links. The Geek Squad invoice scam email gives them nothing to hunt: no link, no login page, just a bill and a phone number. A number is plain text, so the message sails past scanners and lands looking like routine billing. The caller does the real work later. Here is how the trick runs, what it has cost, and the one check that ends it.

Why does a Geek Squad invoice scam email carry no link?

A link is the one thing a mail filter can scan and block, so the scam hides its payload in a phone number, which reads as harmless text and only turns dangerous when you dial it.

Researchers Joshua Long and Kirk McElhearn documented the mechanism at Intego in April 2023. The emails came from a sender named "Intuit E-Commerce Service", relayed through Intuit's own invoicing servers, which spam filters tend to trust. The subject read like a receipt for a three-year Totaltech renewal. So "it came from a real invoicing service" proves nothing, and the standard advice to inspect the sender address no longer settles it. That advice is outdated for this scam. The pattern echoes a toll-text scam that gates its link behind a reply and a fake renewal invoice with an extra-zero refund trap.

The FBI's Internet Crime Complaint Center shows the scale. Its 2024 report logged 36,002 tech and customer-support complaints and $1.46 billion lost. Its 2025 report logged 47,794 and $2.13 billion. Complaints rose 32.8% while losses rose 45.7%, so the average case got costlier, not just more common. Neither report states that comparison; we derived it by setting the two side by side.

Four numbers decide how seriously to take this. The FTC's October 2022 alert supplies the clock, and IC3's 2025 report supplies the rest, with two of them derived by dividing its totals rather than read off a page.

The deadline matters more than the money. A message that demands a call within a day exists to stop you doing the one slow, boring thing that would expose it: opening your own account. Urgency is the product being sold.

Is a Geek Squad invoice email real?

Not on the evidence in the email itself: an invoice proves nothing about whether a charge exists, because anyone can send one through a trusted billing service, so proof has to come from somewhere the sender does not control.

The table sorts the situations by what you have already done. Find your row; the last column carries the fact that decides it. Where a rule comes from the FTC, the row says so.

The common thread is order. The scam needs you to act before you look, so every row puts a look at your own accounts first. The repay row costs real money, and older people meet it more often than their numbers suggest.

Decision: whether an older relative needs this check set up for them before the call comes, since the outer ring shows their share of dollars lost outrunning their share of complaints. Derived by dividing IC3's 2025 age-group totals for people over 60 by its tech and customer-support totals.

Worked example: suppose the email claims a $300 renewal, and the caller says a $5,000 refund landed by mistake. Both figures are illustrative assumptions, not sourced numbers. Repay demanded: $5,000 minus $300 is $4,700. Now open your bank app, a one-minute check that is yours alone to make. If nothing landed, you are asked to send $4,700 against $0 received, so paying costs exactly $4,700. Move the sliders to the three figures in your own situation.

Why did I get an invoice for something I never bought?

Because the sender does not need you to be a customer: a bulk invoice only has to reach the few people who own a plan or fear one lapsed, and everyone else is free noise.

The FTC's alert lays out the escalation. After the call can come a request for remote access, then a story that you were "accidentally refunded too much", then a demand to repay with gift cards. Each step makes the last one harder to walk away from, which is why the first call is the one to skip.

Reports from people over 60 rose 27.2% on 2024 while their losses rose only 5.9%, so the average hit per report fell, though at $48,785 it still sits about 9% above the all-age average. Our opinion, not a finding: IC3 counts only those who file, and we suspect embarrassment keeps many victims out of the totals. Report the message at ReportFraud.ftc.gov. Delete it, or rather report it first, then delete it.

• A valid software signature says who built the support tool, not who is holding it. Intego's caller steered its author to an app signed by ConnectWise.
• A callback number that changes mid-call is a warning. Intego's follow-up number routed to a TextNow voicemail.
• The same trick works by phone: a fake bank fraud call can show your real bank's number, so a familiar caller ID settles nothing.

This week, type the Best Buy address into your browser yourself, sign in to your own Best Buy account, read the plans and charges it lists, and treat the invoice as unproven until they match. Then walk the relative who would pick up that phone through the same two minutes. One limit: this checks the charge, not your bank, so if you already paid or gave screen access, call the number on the back of your card.