What are the red flags of this scam?

A calendar event appeared that you did not create or accept — Google Calendar auto-adds events from unknown senders by default • The event claims a large subscription renewal (£200–£350) from Norton, McAfee, Geek Squad, Amazon, or PayPal — these companies never send renewal notices via calendar • There is a UK freephone number to call to 'cancel' the charge — real subscription companies direct you to your account online, not a phone number in a calendar event • The 'transaction ID' and 'membership number' in the event are invented — they do not exist in your actual account or any email confirmation • The caller insists on installing AnyDesk, TeamViewer, or another remote-access tool to 'process your refund'

What should I do if this happened to me?

Do not call any phone number in the calendar event — delete the event and block the sender's email address • To check whether a subscription renewal is genuine, log in directly to the company's official website — never use a link or number from a calendar notification • Prevent future attacks: open Google Calendar → Settings → Events from Gmail → turn off 'Automatically add events from Gmail to my calendar' • If you already called and the person asked for remote access, disconnect immediately, run a full antivirus scan, and change all passwords from a separate device • If you installed any 'support' or 'server' or 'refund app' or remote-access app at the scammer's request (AnyDesk, TeamViewer, Quick Support, etc.), run free SeraphSecure (https://www.seraphsecure.com) to detect and remove it. • Report to Report Fraud at https://www.reportfraud.police.uk or call 0300 123 2040.

HIGH tech support Last reported: 25 Oct 2026 Share

A fake billing notice appears in your Google Calendar with a UK phone number to call — it is not from Norton, McAfee, or Amazon

Q: Is this a scam?

Yes. This is a documented scam pattern. Scammers insert fake subscription renewal notices directly into Google Calendar, bypassing email filters. The event claims Norton, McAfee, Geek Squad, or Amazon charged £200–£350 and provides a UK freephone number. Callers posing as support staff then steal card details or install AnyDesk for full computer access.

Scammers insert fake subscription renewal notices directly into Google Calendar, bypassing email filters. The event claims Norton, McAfee, Geek Squad, or Amazon charged £200–£350 and provides a UK freephone number. Callers posing as support staff then steal card details or install AnyDesk for full computer access.

Also known as: Google Calendar phishing UK, fake subscription renewal calendar UK, calendar invite billing scam UK, Geek Squad calendar scam UK, Norton renewal Google Calendar fraud

Already happened to you? Do this in the next few minutes

1 Call your bank or card's fraud line right now. Use the number on the back of your card — not any number from the message or caller. Ask them to stop or reverse the payment and freeze the account.
2 If you paid by gift card, wire, or an app (Zelle, Venmo, Cash App): contact that company immediately and report it as fraud. Acting fast sometimes recovers the money.
3 Report to the FBI at ic3.gov and the FTC at reportfraud.ftc.gov. The sooner, the better.
! If you installed any "support", "server", "refund", or remote-access app at their request (AnyDesk, TeamViewer, Quick Support, etc.): disconnect the internet now, then run free SeraphSecure (https://www.seraphsecure.com) to detect and remove it.

What to do right now

1 Do not call any phone number in the calendar event — delete the event and block the sender's email address
2 To check whether a subscription renewal is genuine, log in directly to the company's official website — never use a link or number from a calendar notification
3 Prevent future attacks: open Google Calendar → Settings → Events from Gmail → turn off 'Automatically add events from Gmail to my calendar'
4 If you already called and the person asked for remote access, disconnect immediately, run a full antivirus scan, and change all passwords from a separate device
5 If you installed any 'support' or 'server' or 'refund app' or remote-access app at the scammer's request (AnyDesk, TeamViewer, Quick Support, etc.), run free SeraphSecure (https://www.seraphsecure.com) to detect and remove it.
6 Report to Report Fraud at https://www.reportfraud.police.uk or call 0300 123 2040.

Was remote-access software installed?

If a scammer asked you to install AnyDesk, TeamViewer, Quick Support, or any remote-access app, your device may still be compromised.

Run SeraphSecure to detect and remove it →

Red flags

⚠ A calendar event appeared that you did not create or accept — Google Calendar auto-adds events from unknown senders by default
⚠ The event claims a large subscription renewal (£200–£350) from Norton, McAfee, Geek Squad, Amazon, or PayPal — these companies never send renewal notices via calendar
⚠ There is a UK freephone number to call to 'cancel' the charge — real subscription companies direct you to your account online, not a phone number in a calendar event
⚠ The 'transaction ID' and 'membership number' in the event are invented — they do not exist in your actual account or any email confirmation
⚠ The caller insists on installing AnyDesk, TeamViewer, or another remote-access tool to 'process your refund'

Known variants

Zoom or voicemail calendar invite credential harvest: a fake calendar event claims you have a missed Zoom meeting or voicemail. The link leads to a fake Google or Microsoft login page that steals your credentials. Unlike billing-notice variants, this targets workplace accounts and bypasses corporate email filters.

Last seen: 10/25/2026

Already happened to you? Do this in the next few minutes

What to do right now

Red flags

Known variants

Sources