Fake Geek Squad / Norton / McAfee auto-renewal billing scam — impersonates Best Buy Geek Squad or antivirus brands, claims annual protection plan auto-renewed at $299–499, provides toll-free number to "cancel" that routes to tech-support scammer who takes remote access; FTC 2022–2024: $800M+ in tech-support refund scams; FBI IC3: top-10 consumer fraud by volume; AARP: 60%+ of victims are over 60
fake-geek-squad-norton-auto-renewal-billing-scam
What this tier means
High-confidence threat indicator — phishing, impersonation, BEC, or scam pattern. Strong contributor to the trash decision.
How Gorganizer detects this
Impersonation scam targeting primarily senior consumers: a fake invoice arrives claiming that an annual Geek Squad Total Protection, Norton LifeLock, or McAfee subscription auto-renewed at $299–499, with an order number and a toll-free number to "cancel and get a refund." Calling the number connects to a tech-support scammer who requests remote desktop access (via AnyDesk, TeamViewer, or Zoho Assist), then either directly transfers money from the victim's bank account or tricks the victim into making a wire transfer or purchasing gift cards. Key facts: (1) FTC 2022–2024: Geek Squad and Norton/McAfee impersonation emails are among the highest-volume tech-support scam vectors, contributing to $800M+ in annual tech-support refund losses; the FTC issued a record $60M settlement against a major impersonation ring in 2023; (2) FBI IC3 2023: tech support fraud cost Americans $924M — the second-highest dollar loss category, with impersonation invoices as the primary initial contact vector; (3) AARP Fraud Network: 60%+ of tech-support billing scam victims are over 60, with average losses of $10,000–$20,000 when remote access is granted — the highest per-victim loss of any email-initiated scam; (4) The key tell: real Best Buy, Norton, and McAfee renewal notices arrive from verified company domains and link to in-app account portals — they never include a toll-free phone number as the only cancellation option. Warning signs: invoice from non-bestbuy.com or non-norton.com domain, no link to account management, toll-free phone number as sole cancellation method, order number in format that looks legitimate but is not verifiable online.
False-positive guard
Every signal in Gorganizer feeds a multi-module score — never a sole verdict. This is a threat-tier signal — it adds a strong contribution to the trash score. The full pipeline still requires convergence across multiple modules + a margin over the safety floor before deletion happens, and Gmail's trash (30-day recovery) is always used — never permanent delete.
About the scoring engine
Gorganizer's scoring engine emits 2,143+ signals across six modules — headers, sender, subject, body, attachments, and structural metadata. Every email is scored by every module independently; the final verdict requires multiple modules to agree and the trash score to beat the safety floor by a margin.
Sacred safety guards — never delete starred emails, replies, calendar invites, receipts/invoices, or attachments — apply unconditionally regardless of any signal.
Ready to clean your inbox?
Gorganizer scans your Gmail with this signal and 2,143+ others, then cleans everything in one click. $4.99 one-time, no subscription.
Get started