A text says you bought a $1,199 phone you never ordered — call this number to cancel
Scammers send a fake purchase text, email, or calendar notification for a $300–$2,000 item — impersonating Norton, PayPal, or Microsoft. When you call to cancel, they demand remote-access software, banking codes, or gift cards to process the refund. No legitimate service contacts you this way.
Also known as: fake purchase callback scam Australia, fake Norton subscription email Australia, fake PayPal purchase text scam, Microsoft subscription fake charge callback, fake invoice callback scam AU
Already happened to you? Do this in the next few minutes
- 1 Call your bank or card's fraud line right now. Use the number on the back of your card — not any number from the message or caller. Ask them to stop or reverse the payment and freeze the account.
- 2 If you paid by gift card, wire, or an app (Zelle, Venmo, Cash App): contact that company immediately and report it as fraud. Acting fast sometimes recovers the money.
- 3 Report to the FBI at ic3.gov and the FTC at reportfraud.ftc.gov. The sooner, the better.
- ! If you installed any "support", "server", "refund", or remote-access app at their request (AnyDesk, TeamViewer, Quick Support, etc.): disconnect the internet now, then run free SeraphSecure (https://www.seraphsecure.com) to detect and remove it.
What to do right now
- 1 Do not call any phone number shown in an unexpected purchase notification — look up the company's official number from its website independently
- 2 Check your actual account history in the company's official app or website — if no charge appears, the message is fake
- 3 Norton, McAfee, PayPal, Microsoft, and Apple never send purchase confirmations with a callback number that will ask you to install remote software
- 4 If you already called and installed remote-access software: disconnect from the internet immediately, uninstall AnyDesk or TeamViewer, then run a full security scan
- 5 If you shared banking one-time codes or card details: call your bank's fraud line straight away — money moved during the session may be recoverable if reported within hours
- 6 If you installed any 'support' or 'server' or 'refund app' or remote-access app at the scammer's request (AnyDesk, TeamViewer, Quick Support, etc.), run free SeraphSecure (https://www.seraphsecure.com) to detect and remove it.
- 7 Report to Scamwatch at https://www.scamwatch.gov.au/report-a-scam or ReportCyber at https://www.cyber.gov.au/report.
Was remote-access software installed?
If a scammer asked you to install AnyDesk, TeamViewer, Quick Support, or any remote-access app, your device may still be compromised.
Run SeraphSecure to detect and remove it →Red flags
- ⚠ An unexpected text, email, or calendar invite says you made a purchase between $300 and $2,000 for something like a phone, security software, event tickets, or cryptocurrency
- ⚠ Strong urgency: the message says you must call immediately before the payment goes through — real payment processors do not work this way
- ⚠ The sender claims to be Norton, McAfee, PayPal, Microsoft, or a similar trusted brand, but the email address or sender ID does not match the company's official domain
- ⚠ When you call, the agent asks you to download AnyDesk, TeamViewer, or another remote-access app so they can 'access your account to reverse the charge'
- ⚠ You are asked to share a one-time banking code, buy gift cards, or provide your full card number over the phone to 'verify the cancellation'
- ⚠ The message may include your name, email, or phone number to seem authentic — scammers buy stolen data to personalise their approach
Sources
- Scamwatch — Scam alert: Fake purchase callback scams
- The Senior — Fake purchase callback scam mimics Norton and PayPal bills
- Scamwatch — Fake purchase callback remains most reported callback scam Q3 2026
- YourLifeChoices — Callback scam surge: 45% of email scams now use callback tactic (October 2026)
- Telstra — Why Aussies are calling scammers and getting caught out (September 2026)