# Geek Squad phishing email: check a renewal or invoice > Learn how to check a Geek Squad phishing email, verify a renewal or invoice safely, report the message, and respond if you already paid or called. Treat an unexpected Geek Squad renewal, invoice, or refund email as unverified until you compare it with your own purchase and plan records. Do not call the number, open the attachment, reply, or use a cancellation link in the message. Check through an independently opened Best Buy account, a receipt you already have, or a contact number printed on your own plan documents. ## Quick takeaways - A large renewal charge is a reason to verify, not a reason to call the email's number. - Check whether you have the named plan and whether your own records show the amount. - Do not install remote-access software for someone who contacted you through the message. - Use the number on your receipt, card statement, or existing plan document if you need support. - Report the email through your mailbox and current official help guidance. - Contact your bank through a verified channel if you paid or shared card details. ## What does a Geek Squad phishing email look like? The usual pretext is a charge that appears urgent and expensive. The email may say a support membership or protection plan renewed automatically, an antivirus subscription is about to expire, an invoice has already been paid, or a refund is waiting. The sender then offers a phone number or button to cancel, dispute, or collect the refund. Another version begins with a supposed support problem. The message may claim that a device is infected, an account needs verification, or a technician must connect remotely. The requested action can shift from a phone call to software installation, access to online banking, a gift-card purchase, or a payment. These are pattern shapes, not a report about one campaign. They use the Geek Squad name to create a believable reason for support contact. The critical question is whether your own records show the plan, purchase, appointment, or charge described. The Federal Trade Commission's [phishing guidance](https://consumer.ftc.gov/articles/how-recognize-avoid-phishing-scams) describes impersonation messages that try to obtain money or personal information. A fake support renewal follows that pattern by turning an unfamiliar charge into a sender-controlled call or cancellation process. See the [phishing email examples guide](/learning/phishing-email-examples) for broader examples. This page stays with renewal, invoice, refund, and remote-support decisions. ## Which renewal and invoice details are suspicious? Start with the relationship. Do you have a Geek Squad plan, recent Best Buy purchase, support appointment, or renewal record that could match? Search your own receipts and card statements. Do not use an invoice number or account record attached to the email as independent evidence. Then inspect what the message asks you to do. A phone-only cancellation route, an instruction to call within minutes, a request to keep the call open, or pressure to install software places the sender in control. A refund that requires remote access to your computer or online banking deserves an immediate stop. Read the sender address and Reply-To value, but do not rely on a remembered allowlist. Geek Squad and Best Buy branding can appear in the display name while the actual address uses an unrelated domain. Extra words, misspellings, and unexpected domains support suspicion. A familiar-looking address still does not prove the charge exists. Invoice attachments add no independent proof. They can contain copied branding, a fake order number, and a large amount designed to provoke a call. Leave the file unopened and compare the claim with records you already controlled before the email arrived. ## How do I inspect the phone number and links safely? Do not call the phone number in the message to ask whether the message is fake. That connects you to the same party who supplied the claim. The person answering can use the invoice details as a script and may ask for remote access, banking access, card information, or another payment. Use a number printed on your own receipt, service-plan paperwork, card statement, or other record you trust. You can also start from a Best Buy app or website route you already use and locate the current support path there. Do not copy the URL from the email. Preview any link without visiting it. A familiar brand word inside a longer hostname or URL path is not enough to identify the destination. Compare the complete hostname with the site you reached independently. A button label such as "Cancel renewal" can hide a destination the label never shows. If an authorized reviewer needs to inspect a URL, preserve it without opening it. The [phishing link checker](/tools/phishing-link-checker) can review public signals for the destination, but a clean result does not establish that the invoice or support relationship is real. ## How do I verify a Geek Squad charge? Separate three possible records: the plan or purchase, the invoice email, and the payment-account entry. They should agree, but none should be copied from the suspected message. - Search your own email history for the original purchase or plan enrollment, using messages that predate the suspicious renewal. - If you already use a Best Buy account or app, open it through your normal route and look for the plan or purchase evidence it exposes. - Review the card or bank account independently for a matching posted or pending charge. - Ask another authorized household member whether they made the purchase. - Contact support through a number from your own records if the status remains unclear. An email can claim that a charge has occurred when no payment exists. It can also refer to a real-looking plan name that you never bought. If a genuine charge appears, dispute or manage it only through the payment provider and merchant paths you opened independently. Do not read card details to a caller merely because the caller knows the invoice number. The invoice came from the same source and cannot authenticate the person using it. ## How do I report a Geek Squad phishing email? Locate the reporting process documented for the receiving mailbox. If it arrived at work, use the organization's security process and follow its retention or deletion instructions. Do not assume a universal report button or forwarding address. To notify Geek Squad or Best Buy, open the company's site or app independently and locate its current fraud, scam, or support instructions. Do not guess a reporting address and do not use a form or number contained in the suspicious email. A renewal lure may use a different reporting path from a compromised account or fraudulent transaction. Avoid forwarding the invoice attachment to friends or coworkers. If an authorized reviewer needs the message, submit it only through the method that reviewer documents. The [phishing reporting guide](/learning/report-email-phishing-scams) explains what to preserve and how mailbox, brand, payment, and workplace reports serve different purposes. ## What if I already called or allowed remote access? End the call and do not accept further instructions from follow-up callers. If remote-access software was installed or a session was granted, disconnect according to your incident process and contact an authorized security professional. Do not let the original caller "remove" the software or demonstrate that the computer is clean. Use a trusted device for account recovery. Change any password you entered or revealed, review email and financial-account sessions, and remove unknown recovery methods or connected applications. If you logged in to online banking while someone watched or controlled the device, contact the bank through the number on your card or statement. If you paid by card, bank transfer, gift card, or another method, contact that payment provider through an independently verified route. For installed remote-access software, use the applicable device incident process. Handle the mailbox report through its own documented channel. If you only called and shared no information, end contact and block further calls where appropriate. Still report the email. The [recovery guide after a phishing click](/resources-post/what-to-do-if-you-clicked-on-a-phishing-link) covers credential, device, and payment exposure. ## Why did the Geek Squad email reach me? Delivery alone is not a trust mark. Domain authentication can provide evidence about a sending identity, but it does not establish whether you bought a plan, owe an invoice, or reached genuine support. [SPF, DKIM, and DMARC help receiving systems evaluate domain identity](https://www.rfc-editor.org/rfc/rfc9989.html). They cannot check whether you purchased a protection plan, whether an invoice is owed, or whether a phone number belongs to real support. That business context exists in your account, receipts, and payment records. The guide to [why phishing passes SPF and DKIM](/learning/why-do-phishing-emails-pass-spf-and-dkim) explains the difference between authenticated transport and an honest request. Palisade belongs only at that domain-authentication boundary, not in the consumer support or payment decision. ## A safe decision rule for renewal emails Ignore the email's cancellation process. Search for the underlying relationship in records you already possess: the original purchase, the current plan, the merchant account, and the payment account. Use a contact method from those records if you need clarification. If none of the records matches, report the message and leave it unused. If a real charge matches, manage or dispute it through the independently opened merchant and payment-provider routes. If you installed software, exposed credentials, or sent money, complete those recovery paths immediately. This rule works because it does not depend on how accurate the logo, invoice, tax line, or support language appears. It tests the one fact the sender needs you to assume: that a real commercial relationship or charge exists. ## Sources and further reading - [Federal Trade Commission: How to recognize and avoid phishing scams](https://consumer.ftc.gov/articles/how-recognize-avoid-phishing-scams) - [RFC 9989: Domain-based Message Authentication, Reporting, and Conformance](https://www.rfc-editor.org/rfc/rfc9989.html) - [Palisade phishing reporting guide](/learning/report-email-phishing-scams) - [Palisade phishing email examples](/learning/phishing-email-examples) ## Frequently asked questions ### Does a Geek Squad invoice mean my card was charged? No. Check your bank or card account independently. An invoice in an unexpected email is a claim, not evidence that payment occurred. ### Should I call the cancellation number in the email? No. Use a number from your own receipt, plan document, card statement, or an official site you opened independently. ### Can a real subscription renewal still be handled outside the email? Yes. Open the merchant account or app through your normal route and manage the plan there. Do not return to the email button. ### What if the caller installed remote-access software? End the session, follow your device incident process, and use a trusted device for account recovery. Contact financial institutions through verified channels if banking or payment data was visible. ### Is reporting the email enough after I paid? No. Contact the payment provider promptly and preserve transaction evidence. The mailbox report and payment-recovery process solve different problems.