Fake "your subscription renewed for $399" email
These emails invent a big charge so you call their number. The "agent" then asks to remote into your computer or "refund" you in a way that drains your account.
How this scam works
The invented charge gets you to call the number in the email. The fake billing agent can then request remote access or claim a refund error that you must repay.
Common versions of the message
- A large subscription renewal
- A phone number to cancel the charge
- A refund that requires remote access
What the message looks like
Email from Amazon Billing: Your subscription has been renewed
Your Amazon subscription has been renewed for $399.99. If you did not authorize this charge, call our billing department now at the number below to cancel and receive a refund.
Fictional example based on common, publicly reported scam patterns.
The red flags
- 1
Shock charge: “$399.99”
Big enough to make you panic
The large unfamiliar charge is chosen to create panic before you check your real account or card statement.
- 2
"Call us now": “call our billing department now”
The "agent" will ask to remote into your computer
Calling the supplied number connects you to the sender, not an independently verified billing department.
- 3
Refund bait: “receive a refund”
They "over-refund" you, then demand it back
The promise of a refund moves the conversation toward remote access or an "over-refund" that the caller demands back.
What to do
- Do not call the number in the email.
- Check your account by logging in directly or calling the number on your card.
- Never let a caller install remote-access software.
If you already replied, clicked, or paid
- If you installed remote-access software, disconnect the device from the internet, remove the software, and change passwords from another device.
- If you shared card or bank information, call the number on the card or your bank's official number right away.
- If you sent back a supposed over-refund, report the payment immediately to your bank or payment provider.
Got a message like this?
Paste it into TrustShield's free checker to see the warning signs in seconds. No sign-up needed to try it.