Is this Geek Squad renewal email about a $399 charge real?

The email makes the phone number the only exit.

That is the payload, not the invoice. If the message were about a real Best Buy renewal, you would be able to sign in to your own Best Buy account and see the plan, order, or membership tied to it.

The sender domain is not Best Buy.

Ignore the display name, because “Geek Squad Billing” can be typed into any mailbox. Read the root domain at the end: support@secure-renewaldesk.com belongs to secure-renewaldesk.com, not bestbuy.com.

The link shape, when there is a link, hides the owner at the end.

A URL like bestbuy.geeksquad.confirm-renewal.com is not Best Buy. The root domain is confirm-renewal.com, and everything before it is just decoration to catch a fast reader.

The $399.99 line is there to make the call feel cheaper than the risk.

It is high enough to hurt, but still plausible for a tech support or protection plan, so victims call the listed number before checking whether any money moved.

“Auto Debit Pending” is not proof of a charge.

It is a phrase scammers use because it sounds like the bank is already moving. Your actual bank, card, PayPal, or Best Buy account decides whether a debit exists, not a PDF-style invoice in an email.

The 24-hour cancellation clock is part of the trap shown in the message.

That clock expires the moment you slow down and check your real accounts. The scammer needs you on the phone while the fake loss still feels active.

The invoice number is clean but empty.

Codes like GS-884216 and renewal dates make the message look filed and official. A real order number connects to a purchase history, a device, a plan, or a card transaction, while this one connects only to the cancellation phone number.

The call turns into a fake refund session.

The person on the line says they must “securely process” the $399 refund, then asks you to install AnyDesk, TeamViewer, UltraViewer, or a similar remote tool. Best Buy does not need to watch your bank screen to reverse a card charge.

The overpayment story is the second-stage theft.

After remote access starts, the fake agent says the refund went through as $3,999 instead of $399, then blames you for typing the wrong amount. The screen can be edited, hidden, or blacked out during the session, so the balance you see is part of the theater.

The gift card request exposes the script.

The fake agent may send you to buy Apple, Target, Steam, or Best Buy gift cards to “return the difference,” then asks for the scratched PINs. Best Buy sells gift cards as products, but a Geek Squad refund does not get fixed by reading card codes to billing support.

Do not call the number in the invoice.

That number is the scam’s front door. If you have not called, the fake invoice has no access to your money, your computer, or your Best Buy account.

Check Best Buy the boring way.

Type BestBuy.com yourself or open the Best Buy app, then look for purchases, protection plans, and memberships under your signed-in account. This answers the real question: whether a Geek Squad plan exists outside the email.

Check the card or bank account that you have actually used at Best Buy.

Look for a pending or posted merchant entry from Best Buy or Geek Squad, not just the $399.99 claim in the email. If you see a real charge you do not recognize, call the number on the back of the card and dispute that transaction through the card issuer.

If you already called and the conversation stayed verbal, stop there.

Do not call back, do not accept a return call, and do not read any verification code they send you. Save the email, sender address, phone number, invoice ID, and call time, because those details identify the scam line if you report it.

If you installed a remote tool during the call, cut the session first.

Turn off Wi-Fi or unplug Ethernet, then remove the exact tool they named, such as AnyDesk, TeamViewer, UltraViewer, or Zoho Assist. On Windows, run Microsoft Defender Offline from Windows Security so the scan starts outside the normal session they touched.

If you opened online banking while they watched, treat the bank account as exposed.

From another device, change the bank password and the email password that resets it, then call the bank and say this exact phrase: “I was in a fake Geek Squad refund call with remote access.” Ask them to check new Zelle recipients, bill-pay payees, ACH transfers, wire attempts, and contact information changes.

If you bought gift cards for the fake refund, keep the cards and receipts.

Call the card issuer’s fraud number printed on the card or receipt and ask whether any balance remains, then ask them to freeze or document the card numbers. The scratch-off PINs are the money trail in this version of the scam.

Report the impersonation at ReportFraud.ftc.gov.

Enter Geek Squad or Best Buy as the impersonated business, include the sender domain, phone number, amount, remote-access tool, and gift card brands if used. Keep your saved copy of the email after reporting, because banks and investigators may ask for the headers or the exact phone number later.