Start with three separate questions
A renewal invoice message mixes three things that look related but are not the same:
- The invoice claim. A message says a subscription renewed, a payment is due, or an amount was charged.
- The actual charge. What your bank or card account shows for that period.
- The supposed over-refund. A caller or message says too much was refunded and you must send money back.
Keep these apart. A message can describe a charge that never happened, and a real charge can exist without any message being genuine.
Tech-support scammers send fake subscription-renewal messages asking recipients to call a number. Source
That is why the phone number in the message is the last route to use, not the first.
Compare the message with your statement
Open your bank or card app or statement directly, without using any link or number from the message. Then fill in a simple comparison:
| Question | What the message says | What your statement shows | What it means |
|---|---|---|---|
| Is there a charge? | Amount and date named in the message | A matching debit on the same date or nearby | If no matching debit appears, do not treat the message as proof of a charge |
| Who is the merchant? | Company name in the message | The merchant descriptor on the statement | A different descriptor deserves a direct question to your bank |
| Is a refund involved? | A refund or over-refund described | Any credit actually posted | A refund described only in a message is a claim, not a posted credit |
| What action is requested? | Call a number, click a link, allow access | Nothing requested by the statement itself | A statement never asks you to call a number printed in an unrelated message |
Write down the message’s claimed amount, the date it names, the sender address or number, and the exact wording about any refund. This record helps you describe the problem accurately to your bank or the company.
Why the refund story is the warning sign
A renewal message that ends with a refund is not a routine billing notice. The sequence matters: a call is arranged, then the conversation moves toward access or money moving in the wrong direction.
The resulting call may request remote access and falsely claim an excessive refund must be repaid. Source
If a caller proposes remote access or asks you to return money, stop the conversation. Do not install remote-access software, do not read out one-time codes, and do not send a transfer, gift card or payment to “return” an over-refund. No legitimate correction of an over-refund requires you to move money to a person who contacted you first.
Find a contact route you control
Instead of calling the number in the message, build a contact path from sources you choose:
- Your own records. Use the company name on an earlier genuine statement, a saved receipt, or the account page you normally sign in to.
- Your bank or card issuer. Use the number on the back of your card or inside the bank’s own app. Ask specifically whether a charge from that merchant was posted.
- The company’s own published contact details. Reach the company through a channel you locate independently rather than one supplied in the suspicious message.
The FTC advises independently contacting the named company and checking actual bank or card transactions instead of trusting the message. Source
In practice, that means opening your banking app before dialing anyone, and looking up the company yourself rather than trusting the sender’s contact block.
If the message arrived through a social platform, the account behind it may also be worth checking before you reply. Our guide to checking fake customer-support social accounts covers that separate step.
Decision table: what to do next
| Situation | Sensible next step | What to avoid |
|---|---|---|
| No matching charge on the statement, message demands a call | Treat the message as unverified; contact the company through your own route if you have an account with it | Calling the supplied number to “confirm” |
| A charge is posted and you recognize the merchant | Raise the question with the company through a contact route you found yourself | Assuming the message’s number is the company’s |
| A charge is posted but you do not recognize it | Contact your bank or card issuer using the number on your card or in its app | Sending money anywhere while the charge is unresolved |
| Caller claims an over-refund must be repaid | End the call; verify with your bank and the company independently | Remote access, transfers, gift cards, one-time codes |
| Message includes a link to “view the invoice” | Open your account or statement directly instead of the link | Entering credentials through a link in the message |
A short checklist you can keep
- Save the message without replying to it.
- Record the claimed amount, date, sender and any refund wording.
- Open your bank or card statement directly.
- Note whether a matching charge or credit is actually posted.
- Look up the company’s contact details independently.
- Ask your bank about any charge you cannot match.
- Refuse remote access and refuse to send money to “repay” a refund.
- Keep the record until the question is settled with your bank or the company.
What this check cannot tell you
A statement match confirms that money moved; it does not by itself confirm who sent a message or why. Likewise, the absence of a charge does not prove a message is harmless — it may simply mean the claimed charge was never real. Neither your statement nor a message can settle the question of who is on the other end of a phone number.
This guide describes a verification routine, not a recovery service. It does not promise that a charge will be reversed, and it does not tell you what your bank will decide. Those outcomes depend on your bank and the facts of your case.
Editorial note on sourcing
The scam pattern and the advice to verify independently come from the cited source above. The comparison table, checklist and decision guidance are editorial suggestions for organizing that verification; they are not statements by the source about any particular company, bank or message.