{"id":99616,"date":"2024-01-18T03:02:16","date_gmt":"2024-01-18T11:02:16","guid":{"rendered":"https:\/\/www.intego.com\/mac-security-blog\/?p=99616"},"modified":"2025-02-27T13:06:13","modified_gmt":"2025-02-27T21:06:13","slug":"geek-squad-email-scam-sends-fake-invoices-using-housecallpro-servers","status":"publish","type":"post","link":"https:\/\/www.intego.com\/mac-security-blog\/geek-squad-email-scam-sends-fake-invoices-using-housecallpro-servers\/","title":{"rendered":"Fake \u201cGeek Squad\u201d invoice scam, now using Housecall Pro servers"},"content":{"rendered":"

\"\"<\/p>\n

An email scam has been proliferating since at least last April, where victims receive an invoice claiming to be from BestBuy\u2019s Geek Squad or TotalTech. The fake invoice claims the victim is being billed for a subscription service.<\/p>\n

The alleged pricing is just enough to get victims to react; the latest invoice claims Geek Squad is charging $359.99 for a two-year \u201csecurity services\u201d plan.<\/p>\n

Recipients of the scam email are told, in the invoice itself (odd grammar preserved):<\/p>\n

\u201cIf you didn\u2019t authorize this charge, you have 24hrs. to cancel & get an instant refund of your subscription, to cancel the subscription , reach us at : +1 813 776 1450.\u201d<\/p><\/blockquote>\n

Here’s what you need to know to avoid getting scammed.<\/p>\n

Scammers abuse invoicing services to bypass spam filters<\/h3>\n

In the variations of this scam that we’ve observed, the scammers leverage legitimate invoicing services to send fake invoices. Their use of a legitimate service helps their emails get past spam filters.<\/p>\n

Earlier variants of the scam used Intuit\u2019s QuickBooks; we went into detail about this same in Fake \u201cGeek Squad\u201d emails: Call center scam leverages Intuit QuickBooks servers<\/a>.<\/p>\n

Later variations of the scam sent invoices via PayPal<\/a>. In some cases, they told users they had subscribed to Norton or McAfee software, or were being billed by \u201cBitcoin Exchange.\u201d<\/p>\n

The latest version of the “Geek Squad” invoice scam<\/h3>\n

A new version of this scam has surfaced, and it uses a more obscure company called Housecall Pro. This company apparently offers scheduling, dispatching, and invoicing services for small businesses. They typically work with companies that do home repairs, landscaping, and cleaning.<\/p>\n

Like any online accounting service, Housecall Pro lets people issue invoices. Since they come from a legitimate company, these emails are less likely to be flagged as spam than emails sent from any random address.<\/p>\n

As in the previous versions of this scam, the invoices may look legitimate at first glance. They have a Geek Squad logo and mention its parent company, Best Buy.<\/p>\n

This specific scam email variant has the subject line:<\/p>\n

Invoice 6520091735 from Geek_Squad\u00ae +1 813 776 1450<\/p><\/blockquote>\n

And the body of the email reads as follows:<\/p>\n

Your invoice from Geek_Squad\u00ae +1 813 776 1450<\/p>\n

Hi ,<\/p>\n

Thank you for choosing Geek_Squad\u00ae +1 813 776 1450. Please see attached invoice due upon receipt.<\/p>\n

Invoice Number: 6520091735
\nService Date:
\nInvoice Date: Jan 17, 2024
\nService Address:<\/p><\/blockquote>\n

Note that the service address is left blank. The remainder of the email contains the text of the invoice, which looks like this:<\/p>\n

\"\"<\/p>\n

As in the other versions of this scam, the phone number to call to contest the charge is staffed by fraudsters. We called one of these call centers last year to see how they worked.<\/a> The scammers tell callers to download a \u201cSecure Support App.\u201d If someone installs this app, scammers may trick victims into leaving the support connection open while logged into their online banking account; thus the scammer can steal money from the victim. Moreover, they be able to exfiltrate data from your computer, or plant malware to give the attacker further access later on.<\/p>\n

Many people will fall for this scam. They could have important data, such as usernames and passwords, exfiltrated from their devices; the software they download allows the scammers to take control of their computers. In some cases, the scammers may even steal money directly from their bank accounts.<\/p>\n

One difference with the scam this time is the use of phone numbers with the 813 area code; this happens to be associated with the Tampa, Florida area. However, this doesn\u2019t mean the scammers are located there. The number forwards to a call center, which may not even be located in the United States. Previous versions of this scam used toll-free numbers. The area code alone should be suspicious, unless you happen to live in Florida.<\/p>\n

Not everyone lives near or shops at a Best Buy. But if you have bought something recently from one of their stores, you might not be surprised to see such an email. And you might react to it, thinking that the company is trying to sell you a subscription to a service you never agreed to. The prices on these invoices are high enough to make people upset and act rashly.<\/p>\n

Best Buy is obviously not responsible for this scam. However, the companies who let scammers issue fraudulent invoices have some culpability. For large companies like Intuit and PayPal, it might be difficult to manually police this sort of thing. But at the same time, companies of that size also likely have the resources to develop automated methods to detect and stop such fraud, if they really wanted to. Meanwhile, the scammers find new services to exploit, or new ways to exploit a service they’ve used in the past to generate or send fake invoices.<\/p>\n

Beware of any email of this sort, especially if it doesn\u2019t contain your full name and home address. You don\u2019t owe Best Buy anything, and can safely delete these emails if you’d like to. Or better yet, you can follow our guide below on how to report scam emails to the authorities.<\/p>\n

How can I report these scammers?<\/h3>\n

For fake invoices that appear to have been sent through Housecall Pro<\/strong>, you can forward them to support@housecallpro.com<\/a>.<\/p>\n

If you get a fake invoice that appears to have been sent through Intuit<\/strong>, you can forward it to security@intuit.com<\/a>.<\/p>\n

For fraudulent invoices that appear to come from PayPal<\/strong>, you can forward them to phishing@paypal.com<\/a>.<\/p>\n

It’s also a good idea to forward scam and phishing e-mails<\/strong> to the U.S. Federal Trade Commission (FTC<\/strong>) at spam@uce.gov<\/a>. Additionally, you can CC the Anti-Phishing Working Group at reportphishing@antiphishing.org<\/a>. The APWG<\/strong> is a coalition of international law enforcement agencies and tech companies that work together to take down identity thieves and fraudsters.<\/p>\n

If you believe you’ve fallen victim<\/strong> to one of these scams, inform the FTC; go to ReportFraud.ftc.gov<\/a> and fill out the form. You may also find it helpful to review Intego’s video about how to report scams<\/a> before submitting your report.<\/a><\/p>\n