Subscription scams: renewal and invoice fraud
Fake renewal notices work because most people genuinely cannot list every subscription they pay for.
What it is
A subscription scam is a bill for something you do not have, or a real subscription made deliberately difficult to leave.
The fraudulent version is an invoice or renewal notice for antivirus, a cloud service, a device warranty or a streaming plan, at an amount high enough to prompt action but not high enough to seem absurd, usually a few hundred dollars. The document carries no link and only a phone number, and that number is the scam. Calling it leads to a refund process that requires remote access to your computer or your banking, which is why this overlaps closely with tech support fraud.
A second version is the deceptive free trial: a genuine charge, disclosed in terms almost nobody reads, that converts into a recurring subscription which is straightforward to start and deliberately difficult to cancel.
A third is business invoice fraud, where an organisation receives a plausible bill for supplies, listings or renewals it never ordered.
How it starts
An email, usually. Formatted as a receipt or an invoice, sometimes as a PDF attachment, from a brand you recognise or a plausible-sounding company. The amount is stated, the renewal is described as automatic and already processed, and there is a number to call if you did not authorise it.
Or a text, shorter, about a payment taken or a subscription expiring.
Or a genuine trial you signed up for, where the cancellation route is buried, requires a phone call, or is only available in a window you were not told about.
The invoice variant frequently avoids links entirely, which lets it pass filters built to inspect URLs and forces the interaction onto the phone, where a person can improvise.
Why it works
Nobody has a complete list of their subscriptions. Most households pay for a dozen or more across several cards. An unfamiliar charge is genuinely ambiguous, and the correct instinct is to check.
The emotion is annoyance rather than fear, so it bypasses the caution that a threat would trigger. You are not being scared, you are being mildly inconvenienced, and you call to fix it.
No link means no obvious warning sign. Everything people are taught to look for is absent.
The refund reverses the direction of suspicion. You called them. They are giving money back. That framing carries you into remote access without ever feeling approached.
Deceptive trials are legal enough to be routine. They rely on friction rather than deception, so there is no fraud to report, and the money leaves anyway.
How to spot it
An invoice for a service you do not remember buying, with a phone number and no account link
The amount is a few hundred dollars: high enough to act on, low enough to be plausible
Calling the number leads to a request for remote access or a bank login
The refund is "accidentally" over-paid and you are asked to return the difference
The sender's email domain is not the company's
No account exists when you log into the real service directly
A free trial that requires card details and gives no clear cancellation route
Renewal reminders that arrive close to the cancellation deadline, or after it
What to do
Check the account, not the invoice. Log into the real service directly and look at your billing history. Check your card statement. If there is no charge, there is nothing to resolve.
Never call the number on the invoice. If a charge is real, use the number on your card or the company's own website.
If you called and gave remote access, disconnect from the internet, uninstall the remote software, and change passwords from a different device starting with email and banking.
For a real charge you did not authorise, dispute it with your card issuer. Card networks handle unauthorised recurring charges routinely.
For a subscription you cannot cancel, contact the card issuer and ask to block future payments from that merchant, which you can do independently of the merchant's cooperation. Then complain to the FTC at reportfraud.ftc.gov.
Audit once. Reviewing a card statement line by line, once, usually finds one or two things nobody has used in a year. It also makes the next fake invoice obvious immediately.
---
Have this emailed to you
Send yourself this page so you can forward it, or read it later when you are not standing in a shop.
Email it to myselfPaste a text, email or direct message
A text, an email or a chat message. Take out names and account numbers first.
Add a screenshot
Check it
No account needed.
What happens to your message
Checking the message now. Stay on this page.
Flggd could not check this message just now. Try again in a moment, or use the Flggd app.
Try again
Flggd could not read this image, so it has not been checked. This is not a verdict. Try a clearer screenshot, or paste the text instead.
Paste a message or add a screenshot first.
Text Submission
Image Submission
Flggd Verdict
Scam
Red flag
High confidence of a scam. The content, the sender, the intent and where its requests lead all point the same way. Do not reply, click, call or pay.
Likely to be a scam
Yellow flag
It asks you to act: a link, a number, a reply or a payment. Where that request leads is where the harm starts.
Looks normal
Green flag
High confidence this is normal. The content reads as expected, the sender has a safe history, and anything it asks leads somewhere legitimate. Accounts can be taken over, so if a request seems out of character, check again.
Likely to be a scam
Grey flag
Nothing is asked of you yet. The content, the sender or the intent do not add up. Scams like this start friendly and ask later.
This result could not be shown. Check the message again. If it happens twice, use the Flggd app instead.
Score
Scam type
Confidence
Why Flggd says this
What this message wants you to do
Has anything happened yet?
You do not have to answer. Nothing you tap here is sent or recorded, and the verdict above stands either way.
Change answer
Nothing has happened yet
Good. Checking first is the safest thing to do. Do not tap any link, reply, or call any number in the message. Block the sender and delete the message. If it claims to be from an organisation you know, contact them using details you already trust.
Change answer
You tapped a link
Opening a link does not usually take money or details on its own. The harm comes from what you do on the page it opens. If you entered nothing and installed nothing, close the page and do not go back to it. If it asked you to sign in, enter a code, or install something, and you did, choose Gave details instead.
Change answer
You gave details
Work through this in order. First, if you gave bank or card details, call your bank now on the number on your card. Next, change the password for any account you entered, and for any other account that uses the same password. If you shared a one-time code, tell the organisation it belongs to straight away. Then turn on two-step verification where you can, and watch your statements for anything you do not recognise.
Change answer
You sent money
Call your bank now, on the number on your card or in your banking app. Say: "I have been scammed and I need to stop a payment." The sooner they hear from you, the more they may be able to stop or recover. In the UK you can call 159 to reach your bank. Do not pay anyone who offers to get the money back. That is another scam.
Report it. US: ReportFraud.ftc.gov, and ic3.gov for online crime. UK: reportfraud.police.uk or 0300 123 2040; in Scotland, Police Scotland on 101. Australia: scamwatch.gov.au. Have ready the message, the sender's number or address, and any payment details.
What to do next
Do not reply, click any link, call any number in the message or send money. If it claims to be from an organisation you know, contact them using details you already trust.
Do not reply, click any link, call any number in the message or send money. If it claims to be from an organisation you know, contact them using details you already trust.
No action needed. If the sender later asks for money, codes or personal details, check that message too.
Do not reply at all, not even to say wrong number. A reply tells them the number is live. Block the sender and delete the message. If a request follows, check it again.
Text read from your image
Your image
The closest scam in the Flggd library. Similar, not necessarily the same message.
How this scam works
The closest match is the scam described on this page.
Share this result
Email it to myself
Copied. Paste it anywhere to share it.
Could not copy. Select the text and copy it, or use Email it to myself.
Checked with Flggd at flggd.com
My Flggd verdict
Check the next one on your phone
The Flggd app checks texts, emails and screenshots wherever you are, and teaches you the warning signs as you go. Free on iPhone and Android.
Get the app
What Flggd does about this
Worried about someone else rather than yourself?
Helping someone else
