Scam simulator · Texts and emails

The Surprise Renewal Invoice

An email says you’ve just been charged $499 for a plan you don’t remember buying. Practice what to do, and see how a call to “cancel” can end with a stranger inside your online banking.

About 5 minutes
6 decisions
Common in: US, UK, Australia, Canada and New Zealand (mostly by email, sometimes by text)

Why it matters: Tech and customer support scams, including fake renewals and refunds, cost Americans $2.13 billion in 2025. People aged 60 and over lost $1.04 billion of it. (FBI Internet Crime Complaint Center, 2025 report)

It’s Sunday evening and you’re checking your email. You used to have antivirus protection on your computer, though you can’t remember when it runs out.

Below, each step shows what you'd see, the choices people make, and why each one is safe or risky. The summary at the end tells you what to look for and what to do.

You'll see each message or call as it would really look. Choose what you'd do, and you'll find out why. Nothing here is real: no messages are sent and nothing you choose leaves your device.

Step 1 of 6 First contact

An email arrives that looks like a receipt. The amount jumps out at you.
Practice screen Email: from Billing Department [email protected]

Inbox

INVOICE #TPC-883201: Auto-Renewal Successful

Billing Department <[email protected]>

To: me

This sender is not in your contacts.

Dear Customer,

Thank you for renewing your Total PC Protection plan.

Plan: Total PC Protection, 3 years, 5 devices

Amount charged: $499.00

Payment method: card on file

If you did not authorize this renewal, call our billing department within 24 hours to cancel and receive a full refund:

(888) 555-0162

Thank you for choosing Total PC Protection.
What do you do?

Not sure? Show a hint
Do you really have a plan called Total PC Protection? And why is there only a phone number, with no way to log in?
1. Call the number straight away to cancel. I can’t afford to lose $499.
  
  Risky choice
  
  That’s what the email is for. As one security company put it: “There is no charge. The email exists to get you on the phone with a scammer.” The number goes to a call center run by criminals.
2. Reply to the email saying I never ordered this.
  
  Better, but not the safest
  
  Not calling is good, but replying tells the scammers your email address works and that you’re worried. You may get more emails, or a phone call. It’s better not to reply at all.
3. Don’t call or reply. Check my bank or card statement, or log in to any account I really have by typing the address myself.
  
  Safe choice
  
  That’s the safe way. If there’s no $499 charge on your statement, there’s nothing to cancel. If you still have doubts, call your bank on the number on your card.
Red flags at this step

A charge you don’t recognize, for something you may once have used
A phone number to call instead of a way to log in
A 24-hour deadline
A sender address that doesn’t belong to any company you know
What's really going on

Emails like this often pretend to be from Geek Squad, Norton, McAfee, PayPal or Amazon, and quote a few hundred dollars. They carry no link, just a phone number, which helps them slip past spam filters. Some now come through genuine invoicing tools, such as PayPal’s own invoice feature, so the email really is from the company’s address, with the scammer’s number in the note. PayPal’s advice: don’t pay it, and don’t call any phone numbers in the invoice note.
Step 2 of 6 The hook

Many people do call. Suppose you did. A friendly woman answers and apologizes straight away.
Practice screen Phone call: caller ID shows (888) 555-0162
Call in progress

Caller ID: (888) 555-0162

Caller: “Billing department, this is Sarah. Oh, I’m so sorry about that. A lot of customers were renewed by mistake this week. I can refund the full $499 for you tonight.”

Caller: “To send the refund, I just need to connect to your computer. Please go to refund-desk-support.com, download our secure refund app, and read me the number it shows.”
What do you do?

Not sure? Show a hint
Why would a refund need someone to get into your computer?
1. Download the app and read out the number. She’s being so helpful.
  
  Risky choice
  
  The app gives her full control of your computer. From now on she can see everything on your screen, including your online banking, and can type and click as if she were you.
2. Give her my card number instead, so she can refund it that way.
  
  Risky choice
  
  She’ll gladly take it, and use it. A real company refunds the card it charged, without asking you to read out the number.
3. Say no and hang up. A real refund doesn’t need anyone to get into my computer.
  
  Safe choice
  
  Exactly. Real companies refund the card or account they charged. Nobody needs control of your computer to give you your money back.
Red flags at this step

A refund that needs access to your computer
Being asked to download an app and read out a code
A quick apology and an easy fix, to keep you calm
What's really going on

The friendly apology is part of the script. The FBI has described this exact pattern: an email about a renewal “commonly in the range of $300 to $500,” a number to call for a refund, then a request to download software that gives the caller full control of the computer. Remote access apps are real tools, which is why a request to install one doesn’t always ring alarm bells.
Step 3 of 6 Winning your trust

Suppose you let her connect. She opens a refund form on your screen, and asks you to log in to your online banking in another window.
Practice screen Web page: refund-desk-support.com/secure/refund-form

Web address: refund-desk-support.com/secure/refund-form

Customer Refund Request

Please type the amount of your refund below and press Submit. Your refund will be deposited into your bank account within minutes.

Keep your online banking open so our agent can confirm the deposit.

Refund amount ($)
Submit

Caller: “Don’t worry, I can’t see your password. Just log in and type 499 in the box.”
What do you do?

Not sure? Show a hint
Why would you type in your own refund? Who else can see your screen right now?
1. Log in to my bank and type 499 into the form.
  
  Risky choice
  
  While you’re logged in, she has control of your online banking. As soon as you type the amount, your screen may go black. Behind it, she can move money between your own accounts, or change what the page shows.
2. Refuse to log in. Turn off the Wi-Fi or unplug the internet cable, hang up, and call my bank on the number on my card.
  
  Safe choice
  
  That’s exactly right. Cutting the internet ends her connection at once. The FBI’s advice is never to do any banking while someone else has remote access to your computer.
Red flags at this step

Being asked to log in to your bank while someone controls your computer
A form where you type in your own refund
“I can’t see your password”
What's really going on

Nobody needs you to type your own refund amount, or to watch your bank account while they pay it. The form and the login are there so she can work inside your online banking. The FBI warns that scammers may “place a black screen” over the computer while they do things you can’t see.
Step 4 of 6 The pressure

Suppose you did type the amount. The screen goes black for a minute. When it comes back, your real online banking page shows a much bigger deposit, and the caller sounds upset.
Practice screen Web page: online.yourbank.example/accounts

Web address: online.yourbank.example/accounts

Your Bank: Account Summary

Checking (ending 2208): $7,312.40

New deposit: REFUND TPC PROTECTION +$4,990.00

Savings (ending 5561): $13,418.60

Caller: “Oh no. I typed an extra zero. I sent you $4,990 instead of $499. If I don’t get the $4,491 back tonight, I’ll lose my job. Please, I have children.”
What do you do?

Not sure? Show a hint
Where could that $4,990 really have come from? Could it be your own money, moved from one of your accounts to another?
1. Send back the difference. It was her mistake, and I don’t want anyone losing their job.
  
  Risky choice
  
  It’s natural to want to help, and the scammers count on it. But no money came from her. Either she moved your own savings into your checking account, or she edited the page on your screen. Anything you “send back” is your own money.
2. Don’t send anything. Hang up, disconnect the computer, and call my bank on the number on my card to ask what really happened.
  
  Safe choice
  
  That’s the answer. Your bank can see exactly what moved and where it came from. A real refund never needs you to send anything back.
Red flags at this step

A refund far bigger than it should be
A sob story: “I’ll lose my job”
Being asked to send back the difference
A black screen while someone controls your computer
What's really going on

This is the heart of the scam. While your screen was black, the scammer either moved money from your savings to your checking account, or edited the web page so it only looks as if $4,990 arrived. Either way, none of it came from them. The upset voice and the talk of losing a job are there to rush you before you check.
Step 5 of 6 The ask

The caller now explains how you can “return” the money.
Practice screen Phone call: caller ID shows (888) 555-0162
Call in progress

Caller ID: (888) 555-0162

Caller: “My manager says the bank can’t reverse it, so it has to be gift cards. Please buy $4,491 in gift cards, from two or three different stores so it doesn’t look odd.”

Caller: “Or, if that’s hard, take out the cash, put it between the pages of a magazine, and send it by overnight courier to the address I’ll text you. Please don’t tell the bank what it’s for.”
What do you do?

Not sure? Show a hint
Would a real company ever ask for money back this way?
1. Take out the cash, hide it in a magazine and ship it overnight. It’s the quickest way to put things right.
  
  Risky choice
  
  Hiding cash in a magazine is a warning sign in itself: no real business asks for money that way. Once the package has gone, the cash is very hard to trace. The FBI’s advice is never to send cash through the mail or a shipping company.
2. Buy the gift cards, a few at each store.
  
  Risky choice
  
  Splitting the purchase is meant to stop cashiers noticing and asking questions. Once you read out the card numbers, the money is gone. No real company takes refunds back in gift cards.
3. Refuse. Hang up and call my bank on the number on my card.
  
  Safe choice
  
  Exactly right. The FTC says no real business or government agency will ever tell you to buy a gift card to pay them. Your bank can tell you whether any money really arrived, and protect your accounts.
Red flags at this step

Being told to pay with gift cards or cash
Hiding cash in a magazine and shipping it
Being told to spread purchases across several stores
“Don’t tell the bank”
What's really going on

Gift cards and shipped cash are favorites because, as the FTC says, “once you pay, it’s hard to get your money back.” The FBI has warned that victims of this exact trick are told to send cash wrapped in a magazine by a shipping company, sometimes to pharmacies or stores that accept packages. Real refunds never need you to send anything back.
Step 6 of 6 Afterwards

A few days later, whatever happened before, the phone rings. It’s the same friendly voice.
Practice screen Phone call: caller ID shows (888) 555-0162
Incoming call

Caller ID: (888) 555-0162

Caller: “Hello, it’s Sarah from billing. While I was connected the other day, our system spotted a hacker in your bank account.”

Caller: “Your bank’s fraud team will call you shortly. Please do exactly what they say, and don’t mention it to anyone at your branch.”
What do you do?

Not sure? Show a hint
How would a billing department know what’s happening in your bank?
1. Wait for the fraud team’s call. At least they’re looking out for me.
  
  Risky choice
  
  This is the start of a much bigger scam. The next caller will pretend to be your bank, possibly with your bank’s name on caller ID, and will ask you to move your savings into a “safe” account the criminals control.
2. Hang up, call my bank on the number on my card, and tell a family member everything.
  
  Safe choice
  
  Perfect. Your bank can check your accounts, look for anything the scammer changed, and add extra protection. Telling someone you trust breaks the secrecy the scammers rely on.
Red flags at this step

The same caller coming back with new bad news
Being told your bank will call you
Being told to keep it from your branch
What's really going on

Once scammers know someone will pick up, they come back with a bigger story. This call can lead into what the FBI calls the “Phantom Hacker” scam, where a fake bank and then a fake government agent try to take your savings. Others return weeks later as “recovery” services, offering to get your money back for a fee.

What really happened

There was no $499 charge and no plan to cancel. The invoice was bait to get you to call, and the friendly billing department was a call center run by criminals. The refund form, the black screen and the “$4,990 mistake” were a trick: any money that appeared was your own, moved from your savings or faked on the screen. Checking your real statement, instead of calling the number, stops the whole thing at the first step.

Read your summary

Test your family

How would your family do?

Send this simulator to a parent, grandparent or friend. They try it on their own phone or computer, and at the end they can send their score straight back to you, so you can see which steps caught them out. Then talk it over together.

Your first name (so they know it's from you)

Nothing is sent to us. Your first name and their score travel only inside the link you send, after the # sign, which web browsers never send to our website.

From simulator to confidence

Protect the whole family with Scam-Proof

This simulator is one scam. Scam-Proof puts 50 of today's scams in one calm, large-print book to keep by the phone, for you and the people you love.

This scam is in the book. Chapter 5 covers email scams, and scams 9, 23 and 24 in the book's 50-scam library cover the refund trick, the fake invoice and the subscription renewal.

Spot the three-part pattern behind almost every scam: pressure, secrecy and strange payment
Handle fake bank, tax, Medicare and tech-support calls with word-for-word scripts
Catch out cloned-voice “grandchild in trouble” calls with a family safe word
Check a text, email or website before you tap anything
A 50-scam library with the tell and the fix for each
20 "Say This" scripts for tricky calls and messages

254 pages · 16-point large print · paperback and Kindle ebook · written for older adults and the families who help them

Scam-Proof is almost ready. Leave your email and we'll tell you the day it's on Amazon.

See inside Scam-Proof · Buying it for someone? Read our gift guide.

Summary · keep this

Fake renewal invoice: what to look for and what to do

Remember: Never call the number in a surprise invoice. Check your real statement or account yourself. A real refund never needs you to send anything back.

What to look for

An invoice or receipt for something you didn’t buy, often antivirus, tech support or an online order
A phone number to call to cancel, and a deadline such as 24 hours
A refund that needs access to your computer
Being asked to log in to your bank, or to type in your own refund amount
A black screen while someone is connected to your computer
A refund that’s too big, and a request to send back the difference
Being asked for gift cards, or cash hidden in a magazine and shipped

What to do

An email says you’ve been charged for a renewal or order: Don’t call or reply. Check your bank or card statement, or log in to your real account by typing the address yourself.
The invoice seems to come from a real company’s address: It can still be a scam. Don’t pay it, and don’t call any number in the note. Report it to the company; for PayPal, forward it to [email protected].
Someone offering a refund asks to connect to your computer: Say no and hang up.
You’re told you were refunded too much: Don’t send anything. Disconnect the computer and call your bank on the number on your card.
Anyone asks for gift cards or cash sent by mail or courier: Stop. It’s a scam every time.

If you've already paid, clicked or shared details

Don't be embarrassed. These scams are run by professionals, and acting fast gives you the best chance of stopping the damage.

Disconnect the computer from the internet (turn off Wi-Fi or unplug the cable), then turn it off.
Call your bank straight away on the number on your card, from a different phone if you can. Tell them a scammer had access while you were logged in to online banking.
If you bought gift cards, call the number on the back of the cards, tell them a scammer tricked you, and keep the cards and receipts.
If you shipped cash, call the delivery company straight away (see below for mail in the US).
From a different device, change your passwords and turn on two-step verification. Ask a trusted repair shop to remove the remote access app.
Expect more calls, including offers to recover your money for a fee. Those are scams too.

Where to get help and report it

Show help for

United States

Money gone or card details shared? Call your bank or card company now, on the number on the back of your card.
Report it at ReportFraud.ftc.gov and, for anything online, to the FBI at ic3.gov.
Aged 60 or over? The National Elder Fraud Hotline can help you report and recover: 1-833-FRAUD-11 (1‑833‑372‑8311), Monday to Friday, 10am to 6pm Eastern.
Free advice from trained volunteers: AARP Fraud Watch Network Helpline, 877‑908‑3360. You don’t need to be a member.
Scam texts: forward them to 7726 (spells SPAM).
Gave out personal details? Get a recovery plan at IdentityTheft.gov and think about a free credit freeze.
Someone coming to your door to collect money? Call 911.
Sent cash by mail? Call the US Postal Inspection Service on 1-877-876-2455 straight away. If you used another delivery company, call them as soon as you can.

United Kingdom

Money gone or card details shared? Call 159 to reach your bank safely (it works for most major banks), or use the number on your card.
Report it to Report Fraud at reportfraud.police.uk or 0300 123 2040 (England, Wales and Northern Ireland). In Scotland, call Police Scotland on 101.
Tricked into a bank transfer? Ask your bank about a refund. UK rules cover most transfers up to £85,000 if you claim within 13 months.
Scam texts: forward them free to 7726. Scam emails: forward them to [email protected].
Free, confidential advice: Age UK Advice Line, 0800 678 1602.
Someone coming to your door to collect money or cards? Call 999.

Australia

Money gone or card details shared? Call your bank now, on the number on your card or in your banking app.
Report it to Scamwatch at scamwatch.gov.au. If it happened online, also report it to police through ReportCyber at cyber.gov.au.
Gave out personal details or ID? IDCARE gives free help: 1800 595 160.
Not sure what to do? The Australian Cyber Security Hotline is 1300 CYBER1 (1300 292 371). For police, call the Police Assistance Line on 131 444.
Scam texts: report them to Scamwatch. Telstra customers can also forward them to 7226; other providers may too, so ask yours.
Someone coming to your door to collect money or cards? Call 000.

Canada

Money gone or card details shared? Call your bank now, on the number on your card.
Report it to the Canadian Anti-Fraud Centre: 1‑888‑495‑8501 (Monday to Friday, 10am to 4:45pm Eastern) or online at reportcyberandfraud.canada.ca. Tell your local police too.
Scam texts: forward them to 7726.
Gave out personal details? Ask Equifax and TransUnion to put a fraud alert on your credit file.
Someone coming to your door to collect money or cards? Call 911.

New Zealand

Money gone or card details shared? Call your bank now, on the number on your card.
Report it to Police on 105 (or 105.police.govt.nz) and to the National Cyber Security Centre at ncsc.govt.nz/report or 0800 114 115.
Free advice: Netsafe, 0508 638 723.
Scam texts: forward them free to 7726.
Gave out personal details or ID? IDCARE gives free help: 0800 121 068.
Someone coming to your door to collect money or cards? Call 111.

Ireland

Money gone or card details shared? Call your bank now, on the number on your card.
Report it at your local Garda station. In an emergency, call 999 or 112.
Scam texts: mark them as spam and block the sender. Texts from unregistered senders now show as “Likely Scam”.
Check before you invest: search the Central Bank of Ireland register at registers.centralbank.ie. Scam alerts from Irish banks are at fraudsmart.ie.

The rules that stop almost every scam

Hang up and call back on a number you find yourself: the back of your card, a bill, or the official website.
Never share a code sent to your phone, and never let anyone who contacted you take control of your computer or phone.
Never move money to keep it safe. No bank, police force or government agency will ever ask you to.
Gift cards, crypto, Bitcoin machines, wire transfers, cash couriers and gold are how scammers get paid. Anyone who asks for them is a scammer.
Secrecy and hurry are the giveaways. Anyone who tells you not to tell your bank or family, or to act right now, is working against you.
Tell someone. Talk it over with a family member, a friend or your bank before you pay anyone you didn’t plan to pay.

Phone numbers and web addresses were checked on 28 September 2026. They can change; if one doesn't work, search for the organization's official website, and please let us know.

Sources we checked

The people, numbers, companies and web addresses shown in this simulator are made up. The way the scam works is taken from real cases reported by police, regulators and consumer groups.

Try another simulator

The Computer Virus Pop-Up

Practice what to do when a loud pop-up says your computer is locked: the phone number, the friendly technician, the fake scan and the gift cards.

About 5 minutes · 6 decisions
The Three-Caller Scam

Practice spotting the FBI's "Phantom Hacker" scam: a fake technician, a fake bank fraud team and a fake federal agent who all want your savings.

About 6 minutes · 7 decisions
The Unpaid Toll Text

Practice spotting the fake unpaid-toll text step by step: the link, the "reply Y" trick, the fake payment page and the code that hands over your card.

About 4 minutes · 5 decisions

See all 20 scam simulators

Prefer to read? "Your Computer Is Infected": How to Spot and Stop a Tech Support Scam

Get the free Scam-Stopper Kit

Printable wallet cards, a family safe-word sheet, easy AI prompts and a trusted-numbers sheet for beside the phone. Free when you join the Plainspoken Tech letter.

Cookies

The Surprise Renewal Invoice

The simulator

Step 1 of 6 First contact

Step 2 of 6 The hook

Step 3 of 6 Winning your trust

Step 4 of 6 The pressure

Step 5 of 6 The ask

Step 6 of 6 Afterwards