Geek Squad Invoice Scam Email: No Link

Mail filters hunt for links. The Geek Squad invoice scam email gives them nothing to hunt: no link, no login page, just a bill and a phone number. A number is plain text, so the message sails past scanners and lands looking like routine billing. The caller does the real work later. Here is how the trick runs, what it has cost, and the one check that ends it.

Why does a Geek Squad invoice scam email carry no link?

A link is the one thing a mail filter can scan and block, so the scam hides its payload in a phone number, which reads as harmless text and only turns dangerous when you dial it.

Researchers Joshua Long and Kirk McElhearn documented the mechanism at Intego in April 2023. The emails came from a sender named "Intuit E-Commerce Service", relayed through Intuit's own invoicing servers, which spam filters tend to trust. The subject read like a receipt for a three-year Totaltech renewal. So "it came from a real invoicing service" proves nothing, and the standard advice to inspect the sender address no longer settles it. That advice is outdated for this scam. The pattern echoes a toll-text scam that gates its link behind a reply and a fake renewal invoice with an extra-zero refund trap.

The FBI's Internet Crime Complaint Center shows the scale. Its 2024 report logged 36,002 tech and customer-support complaints and $1.46 billion lost. Its 2025 report logged 47,794 and $2.13 billion. Complaints rose 32.8% while losses rose 45.7%, so the average case got costlier, not just more common. Neither report states that comparison; we derived it by setting the two side by side.

Four numbers decide how seriously to take this. The FTC's October 2022 alert supplies the clock, and IC3's 2025 report supplies the rest, with two of them derived by dividing its totals rather than read off a page.

The deadline matters more than the money. A message that demands a call within a day exists to stop you doing the one slow, boring thing that would expose it: opening your own account. Urgency is the product being sold.

Is a Geek Squad invoice email real?

Not on the evidence in the email itself: an invoice proves nothing about whether a charge exists, because anyone can send one through a trusted billing service, so proof has to come from somewhere the sender does not control.

The table sorts the situations by what you have already done. Find your row; the last column carries the fact that decides it. Where a rule comes from the FTC, the row says so.

The common thread is order. The scam needs you to act before you look, so every row puts a look at your own accounts first. The repay row costs real money, and older people meet it more often than their numbers suggest.

Decision: whether an older relative needs this check set up for them before the call comes, since the outer ring shows their share of dollars lost outrunning their share of complaints. Derived by dividing IC3's 2025 age-group totals for people over 60 by its tech and customer-support totals.

Worked example: suppose the email claims a $300 renewal, and the caller says a $5,000 refund landed by mistake. Both figures are illustrative assumptions, not sourced numbers. Repay demanded: $5,000 minus $300 is $4,700. Now open your bank app, a one-minute check that is yours alone to make. If nothing landed, you are asked to send $4,700 against $0 received, so paying costs exactly $4,700. Move the sliders to the three figures in your own situation.

Would repaying cost you?Set the invoice they claim, the refund they say was sent, and what your bank app shows. The widget subtracts what really arrived from what they demand.

Your numbers

Invoice amount they claim

$300

$100$500Refund they say was sent

$5,000

$500$10,000Landed per your bank app

$0

$0$10,000

Refund they claim

$5,000

Actually arrived

$0

You are out if you repay

$4,700

Your bank app shows nothing landed, so repaying $4,700 would be a pure loss. End the call and report it.Reset to the article's exampleSliders need JavaScript. Figures shown are the article's example.Plain subtraction on your own figures. The over-refund routine is described in the FTC alert of 25 October 2022; the default amounts are illustrative assumptions.

Why did I get an invoice for something I never bought?

Because the sender does not need you to be a customer: a bulk invoice only has to reach the few people who own a plan or fear one lapsed, and everyone else is free noise.

The FTC's alert lays out the escalation. After the call can come a request for remote access, then a story that you were "accidentally refunded too much", then a demand to repay with gift cards. Each step makes the last one harder to walk away from, which is why the first call is the one to skip.

Reports from people over 60 rose 27.2% on 2024 while their losses rose only 5.9%, so the average hit per report fell, though at $48,785 it still sits about 9% above the all-age average. Our opinion, not a finding: IC3 counts only those who file, and we suspect embarrassment keeps many victims out of the totals. Report the message at ReportFraud.ftc.gov. Delete it, or rather report it first, then delete it.

• A valid software signature says who built the support tool, not who is holding it. Intego's caller steered its author to an app signed by ConnectWise.
• A callback number that changes mid-call is a warning. Intego's follow-up number routed to a TextNow voicemail.
• The same trick works by phone: a fake bank fraud call can show your real bank's number, so a familiar caller ID settles nothing.

This week, type the Best Buy address into your browser yourself, sign in to your own Best Buy account, read the plans and charges it lists, and treat the invoice as unproven until they match. Then walk the relative who would pick up that phone through the same two minutes. One limit: this checks the charge, not your bank, so if you already paid or gave screen access, call the number on the back of your card.