Tech Support Scams and Fake Invoices: Geek Squad, McAfee, PayPal

A tech support scam is a pop-up, call, text or email from someone posing as a company you know (Microsoft, Apple, Geek Squad, McAfee, Norton, PayPal) who says your computer has a problem or that you were just charged for a renewal, then asks for remote access to your computer or for payment. The "Geek Squad scam," the "McAfee invoice" and the "PayPal invoice scam" are one playbook with different logos. Posing as a business this way violates the FTC's Impersonation Rule (16 C.F.R. § 461.3), in effect since April 1, 2024, and since January 9, 2025 the Telemarketing Sales Rule also covers the calls people make to a tech support number they saw in an ad.

If it already happened: hang up, then call your bank or card company using the number on the back of your card and tell them a scammer had access to your computer or your account details. Next, uninstall anything the caller had you install, change your passwords, and report it at ReportFraud.ftc.gov and ic3.gov.

Information last verified on October 2, 2026. This article has not been reviewed by a licensed lawyer.

Jurisdiction scope: This article covers US federal law: the FTC's Rule on Impersonation of Government and Businesses (16 C.F.R. part 461), the Telemarketing Sales Rule (16 C.F.R. part 310), section 5 of the FTC Act, the federal wire fraud and computer fraud statutes, and the refund rules in Regulation E (bank transfers and debit cards) and Regulation Z (credit cards). Statements by Microsoft, Apple, PayPal and Geek Squad are company policy, not law. State consumer-protection and computer-crime laws are not covered here.

The three tech support scam scripts

Almost every tech support scam the FTC describes follows one of three scripts. They often blend: a fake invoice leads to a phone call, the call leads to remote access, and remote access leads to a fake refund.

Fake pop-ups and "Microsoft" calls

The FTC describes the classic version this way: "It could be a fake pop-up warning that looks like it's from a well-known company and urges you to call a phone number to get help." Other versions start with a call or text from someone posing as a technician, or with a scam website that shows up in search results or display ads for tech support.

Once you are on the phone, "they ask for remote access to your computer and pretend to scan it for viruses. They claim to find a malicious program and offer to remove it for a fee." Microsoft warns that scammers "might even spoof the caller ID so that it displays a legitimate support phone number from a trusted company."

Geek Squad, McAfee and Norton renewal emails

In the fake invoice script, the FTC says, "you were charged hundreds of dollars to renew your tech support subscription. To get your attention, the scammers use the names of well-known companies like Geek Squad, McAfee, and Norton." The message says you must call a number within 24 hours to dispute the charge. If you call, the scammers ask for remote access.

The FTC's test is simple. Check your real credit card or bank account for a tech support charge. "If you don't see a transaction for a tech support subscription, that tells you the message was a scam. Ignore and delete it." If you think the notice might be real, contact the company "using a phone number you know is real. Do not use the number included in the message."

PayPal invoice scams

The PayPal version uses a real PayPal invoice or money request. PayPal's help center describes it: "You receive an invoice or money request through PayPal containing an alarmist note. The note may ask you to call their fake customer service number in the hope they can obtain your personal/financial details over the phone."

PayPal's advice, as of October 2026, is not to pay it and not to call "any phone numbers stated in the invoice note." In your PayPal Activity, you can select the invoice, then Cancel (on the web) or Decline (in the app), and use "Report this invoice."

The refund over-payment trick

This is the step where the biggest losses in the invoice script happen. After you call to cancel the fake renewal, the FTC says, the scammers "take you to a spoofed website that looks real and tell you to enter your bank or credit card information to process the refund. After you do that, they claim there was an error in the amount entered. They say they refunded you too much money and insist you pay them back with gift cards, a wire transfer, a bank transfer, cryptocurrency, or a payment app."

Whatever balance or "refund" the caller shows you on the screen, do not send anything back. Check your accounts yourself, by logging in on your own or calling the number on your card, not on any page the caller opened. The FTC says plainly that only scammers tell you to buy a gift card and give them the numbers off the back.

The Phantom Hacker escalation: fake tech support, fake bank, fake government

The FBI's Internet Crime Complaint Center (IC3) warned on September 29, 2023 about what it calls the Phantom Hacker scam: "an evolution of more general tech support scams, layering imposter tech support, financial institution, and government personas." The FBI described three phases.

1. Fake tech support. The scammer has you download a program that gives remote access, then "requests the victim open their financial accounts to determine whether there have been any unauthorized charges." The FBI calls this "a tactic the scammer uses to determine which financial account is most lucrative."
2. Fake bank. Someone posing as your financial institution tells the victim they "must move their money to a 'safe' third-party account, such as an account with the Federal Reserve or another US Government agency." The FBI says the scammer "tells the victim to not inform anyone of the real reason they are moving their money."
3. Fake government. The scammer "may send an email or a letter on what appears to be official US Government letterhead" and presses you to send money to a new "alias" account.

The FBI says victims are told to transfer money "via a wire transfer, cash, or cryptocurrency, often directly to overseas recipients," sometimes in "multiple transactions over a span of days or months." The FTC describes the same pattern from the other side: the fake technician claims your accounts were hacked, "or that your name is linked to serious crimes, like money laundering or drug trafficking," then transfers you to a fake government official.

"Someone who works for the government will never tell you to put your money in a federal safety locker. There's no such thing." (FTC, How To Spot, Avoid, and Report Tech Support Scams)

Couriers collecting cash and gold

In a January 29, 2024 alert, the FBI said scammers in tech support and government impersonation schemes "instruct victims to liquidate their assets into cash and/or purchase gold, silver, or other precious metals." Sometimes, the FBI says, scammers have victims "wire funds to a metal dealer who will ship the precious metals to victims' homes." A courier then collects the cash or metal, and scammers "may direct victims to authenticate the transaction with the courier using a passcode, such as the serial number of a US dollar bill." The FBI's conclusion: "In reality, victims never hear back from the scammers and lose all their money."

That alert reported aggregated losses of over $55 million from May to December 2023. In a September 22, 2025 release, the FBI's Boston field office reported that nationwide, from 2023 to May 2025, "the FBI documented at least 1,737 instances of a courier being used to pick up bulk cash or gold bars, with financial losses totaling approximately $186,263,191." The Boston office also described victims being passed to someone impersonating an FTC or Department of Justice representative who claims the money must go into "a DOJ escrow or bank account."

Watch out: The FBI says, "The US Government and legitimate businesses will never request you purchase gold or other precious metals," and advises, "Never disclose your home address or agree to meet with unknown individuals to deliver cash or precious metals."

The FTC's own warning, printed at the top of its tech support page: "The FTC will never threaten you, say you must transfer your money to 'protect it,' or tell you to withdraw cash or buy gold and give it to someone."

Warning signs of a tech support scam

Each of these comes from the FTC, the FBI or the company being impersonated.

• Contact you did not start. The FTC: "Legitimate tech companies won't contact you by phone, email, or text message to tell you there's a problem with your computer."
• A pop-up with a phone number. The FTC: "Real security pop-up warnings and messages will never ask you to call a phone number." Microsoft says its error and warning messages "never include phone numbers."
• A number to call to cancel a charge in an email, text or invoice note.
• A request for remote access to your computer or phone.
• Payment by gift card, wire, bank transfer, crypto or payment app. The FTC says scammers want these "because it's like using cash."
• Being told to move money to protect it, withdraw cash, buy gold, or hand anything to a courier.
• Being told not to tell anyone the real reason you are moving money, which the FBI flags in the Phantom Hacker scam.
• A support number you found through a sponsored search result. The IC3 says numbers in a "sponsored" results section "are often boosted because of Search Engine Advertising."

Pro tip: Not sure? The FTC suggests talking to someone you trust, such as a friend, family member or neighbor, before you do anything. If you really think your computer has a problem, update your security software and run a scan yourself.

What to do right now if you were scammed

Speed matters most when money has moved. The IC3 says, "If you discover a fraudulent transfer, time is of the essence."

1. Hang up and stop replying. Microsoft: "If you receive an unsolicited call from someone claiming to be from Microsoft Support, hang up." Do not call any number from the message or invoice.
2. Call your bank and card companies. Use the number on the back of your card, or log in through the official website or app, as the FTC advises. Say a scammer had remote access to your computer, or that you entered your card or bank details on a fake refund page, and ask them to stop or reverse the payments. For a wire, ask for a recall of the funds, which is the IC3's advice.
3. Remove what the scammer installed. Microsoft says to "uninstall any applications that scammers have asked you to install" and, if you gave them access to your device, "consider resetting it." The FTC says to update your security software, run a scan and delete anything it flags.
4. Change your passwords and turn on two-factor authentication. If you used the same password on other accounts, change it there too, the FTC says.
5. If you gave your Social Security number, use IdentityTheft.gov. Our guide on how to report identity theft walks through it, and a credit freeze or fraud alert can block new accounts in your name.
6. Report it. File with the FTC at ReportFraud.ftc.gov (Spanish: reportefraude.ftc.gov) and with the FBI at ic3.gov, and contact your local FBI field office. The FBI asks you to include names the scammers used, how they contacted you, and the bank account numbers and recipient names involved. People 60 and older who need help filing an IC3 complaint can call the DOJ Elder Justice Hotline at 1-833-FRAUD-11 (833-372-8311).
7. Report it to the company that was impersonated. Microsoft takes reports at www.microsoft.com/reportascam, and PayPal has a "Report this invoice" option.

Our guide to where to report a scam explains what each agency does with your report.

Can you get your money back? It depends on who moved it

Your refund rights turn on one question: did the scammer move the money, or did you send it yourself after being tricked? Federal law gives real protection in the first case and much less in the second.

When the scammer moved money out of your account

Regulation E defines an unauthorized electronic fund transfer as one "initiated by a person other than the consumer without actual authority to initiate the transfer and from which the consumer receives no benefit" (12 C.F.R. § 1005.2(m)). The Consumer Financial Protection Bureau has said this covers the remote-access situation directly. From its Electronic Fund Transfers FAQs (Unauthorized EFTs, Question 5):

"when a consumer is fraudulently induced into sharing account access information with a third party, and a third party uses that information to make an EFT from the consumer's account, the transfer is an unauthorized EFT under Regulation E. For example, the Bureau is aware of the following situations where a third party has fraudulently obtained a consumer's account access information, and thus, are considered unauthorized EFTs under Regulation E: (1) a third-party calling the consumer and pretending to be a representative from the consumer's financial institution and then tricking the consumer into providing their account login information, texted account confirmation code, debit card number, or other information that could be used to initiate an EFT out of the consumer's account, and (2) a third party using phishing or other methods to gain access to a consumer's computer and observe the consumer entering account login information. EFTs stemming from these situations meet the Regulation E definition of unauthorized EFTs."

The CFPB also says a bank cannot use your carelessness to make you pay more than Regulation E allows: "negligence by the consumer cannot be used as the basis for imposing greater liability than is permissible under Regulation E" (FAQ Question 7).

The deadlines matter. A bank's error-resolution duties apply to a notice it receives no later than 60 days after it sends the statement that first shows the problem (12 C.F.R. § 1005.11(b)(1)). The bank must then decide within 10 business days, or take up to 45 days if it provisionally credits your account (12 C.F.R. § 1005.11(c)). Our guide on how to get money back after a scam covers the liability tiers and timelines in full.

For credit cards, Regulation Z caps your liability for unauthorized use at the lesser of $50 or the amount charged before you notify the issuer (12 C.F.R. § 1026.12(b)). The official commentary says unauthorized use includes a transaction by someone who obtained the card from you "through fraud," which is what happens when a scammer collects your card number on a fake refund page. A written billing-error notice must reach the issuer no later than 60 days after the first statement showing the charge (12 C.F.R. § 1026.13(b)).

When you sent the money yourself

The over-payment "refund," the Phantom Hacker "safe account" and the courier pickup all depend on you moving the money. The Regulation E definition above, as written, covers transfers "initiated by a person other than the consumer." A transfer you start yourself, even because of a fake bank officer's story, generally falls outside that definition, and banks and payment apps often treat it as authorized. Any refund then usually depends on the provider's own policy. Ask anyway: the FTC's instruction for nearly every payment method is to report it immediately and ask for the payment to be reversed.

For payment apps and Zelle specifically, see Zelle and payment app scams.

Watch out: Telemarketers cannot legally take two payment types: a remotely created payment order, and a cash-to-cash money transfer or cash reload mechanism (16 C.F.R. § 310.4(a)(9) and (10)). That rule does not name gift cards or cryptocurrency. A demand for gift cards is still a classic scam sign, but no federal rule makes a gift card payment automatically reversible.

Beware the follow-up "recovery" scam

People who lose money to a tech support scam are often contacted again. The FTC calls refund and recovery scams "the worst of the worst: scams that target people who have already lost money to a scam." Scammers buy lists of people who have paid scammers before, then pose as "a government agency, a consumer advocacy group, a law firm, or some other organization" and ask for an upfront fee. The FTC's rule of thumb: "Did someone contact you and ask for an upfront fee? That's a scammer."

The FBI has issued repeated warnings about fake law firms targeting scam victims. Its August 13, 2025 alert says, "There are no law firms which are officially authorized partners of US Government agencies," and a June 2024 alert notes that "Law enforcement does not charge victims a fee for investigating crimes."

Under the Telemarketing Sales Rule, a telemarketer may not request or receive a fee for recovering money you lost in an earlier transaction "until seven (7) business days after such money or other item is delivered to that person" (16 C.F.R. § 310.4(a)(3)). The rule does not apply to services provided by a licensed attorney, and it applies to telemarketing.

What Microsoft, Apple, PayPal and Geek Squad say

These are company statements, current as of October 2, 2026. They are policy, not law, and can change.

We could not verify an official statement from McAfee or Norton about these scams, so we do not quote one. The FTC confirms that scammers use both names in fake renewal notices.

Federal laws against tech support and fake invoice scams

The FTC Impersonation Rule (16 C.F.R. part 461)

The FTC's Rule on Impersonation of Government and Businesses took effect April 1, 2024. Section 461.3 is the provision that covers a scammer posing as Microsoft, Geek Squad, McAfee or PayPal:

"It is a violation of this part, and an unfair or deceptive act or practice to: (a) materially and falsely pose as, directly or by implication, a business or officer thereof, in or affecting commerce ... (b) materially misrepresent, directly or by implication, affiliation with, including endorsement or sponsorship by, a business or officer thereof" (16 C.F.R. § 461.3)

Section 461.2 applies the same prohibitions to impersonating a government entity or official, which covers the fake FTC, Federal Reserve and Justice Department callers in the Phantom Hacker script. "Materially" means "likely to affect a person's choice of, or conduct regarding, goods or services."

When the rule took effect, the FTC said it enables the agency to file "federal court cases seeking to get money back to injured consumers and civil penalties against rule violators." In a June 15, 2026 release, the FTC said it had brought "a dozen enforcement actions" under the rule and "obtained over $70 million in redress for consumers."

The Telemarketing Sales Rule now covers inbound tech support calls

The Telemarketing Sales Rule, issued under 15 U.S.C. § 6102, exempts many calls that a consumer places in response to an ad. The FTC amended it in a rule published December 10, 2024, so that exemption no longer reaches tech support. The amendments "extend the Rule's applicability to inbound telemarketing calls in response to an advertisement through any medium or direct mail solicitation in which technical support products or services are offered for sale." They took effect January 9, 2025.

The operative text is in 16 C.F.R. § 310.6(b)(5)(i) and (b)(6)(i): the exemptions for customer-initiated calls do not apply to calls "in response to an advertisement relating to investment opportunities, debt relief services, technical support services" (§ 310.6(b)(5)(i)) or to calls responding to a direct mail solicitation relating to technical support services (§ 310.6(b)(6)(i)). The rule defines a technical support service (16 C.F.R. § 310.2(gg)) as:

"any plan, program, software, or service that is marketed to repair, maintain, or improve the performance or security of any device on which code can be downloaded, installed, run, or otherwise used, such as a computer, smartphone, tablet, or smart home product"

The definition excludes service where the provider "obtains physical possession of the device being repaired," such as an in-store repair. The rule also bans misrepresenting "a seller's or telemarketer's affiliation with, or endorsement or sponsorship by, any person or government entity" (16 C.F.R. § 310.3(a)(2)(vii)).

FTC Act section 5

Section 5 of the FTC Act declares "unfair or deceptive acts or practices in or affecting commerce" unlawful (15 U.S.C. § 45(a)(1)). It is the FTC's general authority behind tech support enforcement cases.

Federal crimes: wire fraud and computer fraud

Wire fraud covers anyone who devises a scheme to defraud or to obtain money "by means of false or fraudulent pretenses, representations, or promises" and uses interstate wire, radio or television communications to carry it out. The maximum sentence is 20 years in prison, or 30 years if the violation affects a financial institution (18 U.S.C. § 1343).

The Computer Fraud and Abuse Act makes it a crime to knowingly, "and with intent to defraud," access "a protected computer without authorization, or exceeds authorized access," and by that conduct further the fraud and obtain anything of value, unless the only thing obtained is use of the computer worth $5,000 or less in a year (18 U.S.C. § 1030(a)(4)). A first offense under that paragraph carries up to five years. Whether access a victim was tricked into granting counts as "without authorization" is a legal question this article does not resolve.

These are criminal laws enforced by prosecutors. In its 2025 annual report, the IC3 describes Operation Chakra (December 2025), in which six people were arrested in Noida, India, for "duping more than 600 U.S. citizens through tech-support scams and impersonating U.S. agencies," with "more than $48.7 million in losses attributed."

FTC cases against tech support operations

• Restoro and Reimage (March 14, 2024). Two tech support companies agreed to pay $26 million to settle FTC charges under the FTC Act and the Telemarketing Sales Rule. The FTC said consumers were "lured or alarmed by fake Microsoft Windows pop-ups." This was a settlement, not a court finding.
• Paddle (June 16, 2025). Payment processor Paddle agreed to pay $5 million to settle FTC allegations of facilitating deceptive tech support schemes. The FTC's case page lists the matter as under order, with a stipulated order dated June 20, 2025 that permanently bans Paddle from processing payments for tech support telemarketers. This was a settlement, not a court finding.

Pending: platforms that enable impersonation

On October 1, 2026, the FTC published an advance notice of proposed rulemaking on conduct by platforms that furthers government and business impersonation (Federal Register document 2026-20143). "Comments must be received on or before November 30, 2026." This is an early-stage proposal, not a rule. The same notice says that for a separate provision on impersonating individuals, the Commission "held an informal hearing in January 2025 and is still evaluating its options," so that provision is not in force.

How much tech support scams cost

The FBI's IC3 2025 Annual Report shows reported tech support losses rising fast:

In 2025 the IC3 received 47,794 tech support complaints. Government impersonation added 32,424 complaints and $797,943,193 in losses. The IC3 says combined call center fraud in 2025 totaled "more than 80,000" complaints "with losses exceeding $2.9 billion."

Older adults carry much of this. People 60 and older reported $1,040,730,043 in tech support losses in 2025 from about 21,300 complaints, the second-largest loss type for that age group. By our calculation that is about 49% of all tech support losses reported to the IC3. In its 2023 Phantom Hacker alert, the FBI said almost 50% of tech support victims reporting from January to June 2023 were over 60, accounting for 66% of losses.

The FTC's data tells a similar story. In a June 15, 2026 release covering 2025, the FTC said people reported losing $3.5 billion to imposter scams, "nearly $1 billion to business impersonators" and "about $920 million to government impersonators," adding that "some of the costliest impersonation scams start with a fake security alert, often from a bank." FTC and IC3 figures are separate, self-reported datasets, so they should not be added together.

Related guides

• Scams and fraud laws: the complete guide
• How to get money back after a scam
• Zelle and payment app scams
• Where to report a scam
• Phishing, smishing and vishing
• AI voice scam calls
• Identity theft laws

Last updated: October 2, 2026.

Disclaimer: This article provides general legal information about US federal law as verified on October 2, 2026. It is not legal advice, and company policies described here can change at any time. For your specific situation, contact your bank, card issuer or payment company, the agency named above, or a lawyer licensed in your state.

Frequently Asked Questions

Is the Geek Squad renewal email a scam?

The FTC says scammers use the Geek Squad name in fake tech support renewal notices that tell you to call a number within 24 hours. Check your real card or bank account; if there is no such charge, the FTC says the message was a scam. Geek Squad says it will never call you unsolicited to start a remote support session.

Is the McAfee or Norton invoice email real?

The FTC names McAfee and Norton among the brands scammers use in fake renewal invoices. Do not call the number in the message; check your accounts and contact the company at a number you know is real.

What is the PayPal invoice scam?

PayPal says scammers send a real PayPal invoice or money request with an alarmist note and a fake customer service number. PayPal's advice is not to pay it, not to call any number in the note, and to cancel or decline it and use Report this invoice.

Does Microsoft call people about viruses on their computer?

Microsoft says it does not make unsolicited calls to provide technical support, and that its error and warning messages never include phone numbers. Its advice for such a call is to hang up.

I let a scammer into my computer. What should I do first?

Call your bank and card companies using the number on the back of your card, then uninstall anything the scammer had you install, run a security scan, and change your passwords with two-factor authentication turned on. Report it at ReportFraud.ftc.gov and ic3.gov.

Will my bank refund money a scammer took while he had remote access?

The CFPB says a transfer made by a third party who gained access to your computer and watched you enter your login information is an unauthorized transfer under Regulation E. Your bank must investigate a notice received within 60 days after the statement showing it, generally within 10 business days (12 C.F.R. § 1005.11).

What is the Phantom Hacker scam?

It is the FBI's name for a tech support scam that escalates through a fake bank and a fake government agency, which tell the victim to move money to a 'safe' account, such as one supposedly at the Federal Reserve. The FTC says someone who works for the government will never say you must transfer your money to protect it.

Can I get back cash or gold I gave to a courier?

The FBI and FTC guidance we reviewed lists no way to reverse a cash or gold handoff. The FBI asks victims to report to ic3.gov as quickly as possible and to their local FBI field office; people 60 and older can get help filing at 833-372-8311.

Is it illegal to pretend to be Microsoft or Geek Squad?

Yes. The FTC Impersonation Rule makes it unlawful to materially and falsely pose as a business or misrepresent affiliation with one (16 C.F.R. § 461.3), and the FTC can seek money back for consumers and civil penalties.

Someone offered to recover my lost money for a fee. Is that legitimate?

The FTC says anyone who contacts you and asks for an upfront fee to recover money is a scammer. The Telemarketing Sales Rule bars telemarketers from collecting recovery fees until seven business days after the money is delivered, except for licensed attorneys (16 C.F.R. § 310.4(a)(3)).