Should I call the number in the email to cancel?

NO. That number goes directly to a scam call center. If you want to check your orders, log into the official website (e.g., Amazon.com) directly via your browser.

I already called and they 'refunded' me. What now?

If they had you install software like AnyDesk or TeamViewer, they likely have access to your computer. Disconnect from the internet and contact your bank immediately.

Why is the receipt for such a large amount?

The large amount (usually $300-$600) is designed to maximize your panic so you call the 'Refund' number without double-checking the sender's email.

Receipt Checker

Verify suspicious receipts before you 'cancel' the order.

Scammers send fake email receipts for expensive items (like MacBooks or Norton Antivirus) to induce panic. They include a 'Help Desk' phone number or a 'Cancel Order' link designed to steal your bank login or install remote access software.

Security Insight

The goal of a fake receipt isn't usually to steal the 'payment' amount shown—it's to get you on the phone. Once you call, they claim you were over-refunded and trick you into sending them real money via wire or gift cards.

Identifies fake 'Help Desk' numbers

Spots 'Cancel Order' phishing links

Protects your banking credentials

Analyze a Receipt Refund Scam Guide

How to spot a Fake Payment Confirmation

Official receipts from Apple, PayPal, and Amazon follow consistent branding and security protocols. Watch out for these specific red flags in any billing alert.

The 'Refund Desk' phone number

If the email insists you must call a number to cancel the order instead of using the official app, it is a 'Refund Scam' lure.

Generic or 'Dear Customer' greeting

Official receipts for products you actually own will use your real name and usually the last 4 digits of your payment method.

Sent from a public email domain

An 'Amazon' receipt sent from @gmail.com, @outlook.com, or a random string of characters is a guaranteed fake.

Attachments formatted as .html or .zip

Real receipts are either in the email body or a PDF. Attachments that require opening a browser file are used to host phishing forms.

What IsThisSpam checks before you trust a sender

Quick verdicts are useful, but the real value is understanding why something looks safe, uncertain, or risky.

Unexpected 'Auto-Renewal' notice

Claiming a large subscription (e.g., $499) was just renewed for a service you've never used or canceled months ago.

Poorly Scaled Logos

Scammers use low-resolution or stretched logos of companies like PayPal, McAfee, or Geek Squad to appear official.

Link leads to a different domain

The 'Cancel Subscription' button shows 'amazon.com' but actually links to a site like 'help-desk-billing-portal.net'.

Grammatical errors in 'Legal' footer

The fine print at the bottom often contains strange spacing, character encoding errors, or awkward translations.

Related guides

Use the checker for the fast answer, then read the deeper guidance for recurring scam patterns.

Refund Scam Checker

Specific guide for identifying 'Overpayment' and 'Tech Support' refund fraud.

Read the guide

PayPal Scam Checker

Broad guide for identifying fake PayPal 'Money Received' and 'Account Restricted' alerts.

Read the guide

FAQ

These are the questions people usually ask right before they click, reply, or pay.

Got a screenshot or attachment? Our AI can analyse it.

Free scan first, deeper analysis when you need it

Check the sender before you trust the message.

Start with a fast scan, then move to SuperScan when the message involves money, account access, or sensitive documents.

Analyze a Receipt Refund Scam Guide