How to Spot Geek Squad Email Scams in 2026: A Mac User's Guide

A Geek Squad email is probably a scam if it says a plan you don't recognize renewed for hundreds of dollars, then gives you a phone number and a deadline to cancel. Don't call. On your Mac, check the sender, then look for the charge in your bank and Best Buy accounts yourself.

I've never owned a Geek Squad plan, and one of these notices still reached me on a Sunday night. For a moment my hand went to my phone, because a surprise charge makes you want to fix it right now. That reflex is what the email is built on. This guide covers what to look for, the checks you can run in Apple Mail, how to confirm whether a charge is real, where to report it, and how to clean up your Mac if you already called.

What the Geek Squad email scam looks like

The Geek Squad email scam is a fake renewal notice that tries to get you on the phone. The Federal Trade Commission's alert describes the pattern: a text or email claims you were or will be charged hundreds of dollars for a Geek Squad membership, and you have 24 hours to call a number to dispute it. Geek Squad is the real tech support service run by Best Buy, which is why the name works.

The phone call is where the damage happens. The FTC says the person who answers may ask for remote access to your computer, then install spyware, steal your banking logins and empty your account. A second version claims you were refunded too much by mistake and asks you to "pay back" the difference with gift card numbers and PINs.

This scam is common, not a one-off. The FTC's data for 2023 put Best Buy and Geek Squad first among impersonated companies, with about 52,000 reports, and CBS News reported about $15 million in losses tied to them. Those are the latest company-by-company figures I could find, so treat them as a snapshot.

One real sample, taken apart

Brown University's IT team publishes the fake invoices its staff receive. Here's what one from November 2023 said, and what each part gives away.

How to spot a fake Geek Squad email: 7 checks

A fake Geek Squad email usually fails several of these checks at once. One odd detail can be innocent; three together shouldn't leave much doubt.

1. You don't remember buying the plan. The FTC's phishing guide starts with this question: do you have an account with this company at all? Unfamiliar invoices are on its list of warning signs.
2. The sender doesn't match the company. Apple's guide to spotting scams names a mismatched sender as a warning sign. Look at the address itself, not the display name.
3. There's a phone number and a short deadline. The FTC's description of the scam is a call-within-24-hours demand. Renewal notices for tech support subscriptions you didn't order are one of the FTC's listed signs.
4. The bill arrives as an attachment or image. Brown's archive flags invoices that are attached or embedded. Malwarebytes documented a version with an empty body, the recipient hidden in BCC and a fake invoice as the only content.
5. The greeting could be anyone. The FTC lists generic greetings as a sign. A company billing you normally knows your name.
6. It asks you to confirm personal details. Best Buy says it will never ask you to "verify" personal information online.
7. Someone wants gift cards. Best Buy says its gift cards can't pay bills, bail or taxes, so a request to settle anything with one is a scam.

Spelling mistakes get a lot of attention in guides like this one, and they do show up. I wouldn't lean on them, because a clean, well-designed invoice proves nothing. Trust the checks above over how polished the email looks.

How to check a suspicious email on your Mac

Apple Mail lets you check a Geek Squad email's real sender, links and delivery details without opening the attachment or calling anyone. The menu path for the headers comes from Apple's Mail guide.

1. Select the message in Mail and leave any attachment closed.
2. Look at the address beside the sender's name. If Mail shows only a name, the headers in step 4 will show you the address.
3. Hover your pointer over any link without clicking. Apple's advice is to treat the message as suspicious if the address doesn't match the company's website.
4. For more detail, choose View > Message > All Headers, then find the From line and compare its address with the company's website. To go back, choose View > Message > Default Headers.

Our guide to showing full email headers in Mail explains how to read what appears, including the Authentication-Results line.

Using Gmail in Safari instead? Google's phishing page suggests the same comparison: sender address against sender name, whether the message is authenticated, and what the headers show. Link hovering works there too, and if Safari isn't showing you the address, Apple says to turn on View > Show Status Bar.

How to tell if a Geek Squad charge is real

To find out whether a Geek Squad charge is real, ignore the email and go to the accounts where a real charge would appear. The FTC's advice comes down to this: check your own statements, and contact the company using a number you know is genuine.

1. Open your bank or card app, or type your bank's web address into a new Safari tab. Look for the amount and any Best Buy or Geek Squad entry.
2. Type bestbuy.com into Safari yourself, sign in if you have an account, and look through your orders and memberships.
3. Still unsure? Use a contact method listed on BestBuy.com, or call 1-888-BEST BUY (1-888-237-8289), the number Best Buy gives on its own fraud page.
4. If a charge you don't recognize does appear, report it to your bank or card company and ask them to reverse it.
5. If nothing is there, the FTC says the message was likely a scam. Report it and delete it.

When a relative forwarded me one of these and asked what to do, this was the whole conversation: don't call, open your banking app, tell me what you see. Nothing was there, and that was the end of it. An email can claim a charge, but only your statement can show one.

Be careful about searching for a support number. I've seen pages in search results listing "Geek Squad" numbers that disagree with each other, and many look like they exist only to catch that search. Start from BestBuy.com instead.

How to report a fake Geek Squad email on your Mac

Report a fake Geek Squad email in two places: with your email app's own Junk or Report phishing option, and to Best Buy. Its fraud page recommends the first and takes suspected Geek Squad scams at abuse@BestBuy.com. The Anti-Phishing Working Group and FTC rows are optional extras. After that, you can delete the message.

When you forward from Mail, choose **Message** > **Forward as Attachment** rather than a plain Forward, so the original travels with its headers intact. One address to skip: reportphishing@apple.com is for messages pretending to be from Apple, and a fake Geek Squad invoice isn't one of those.

Blocking is worth less than it sounds, since nothing stops the same scam arriving from a new address. If these keep getting through, our guide to Apple Mail's junk settings goes further on training the filter.

Already called, clicked or paid? What to do next

If you already engaged with a fake Geek Squad email, act on what you actually handed over, starting with money. Being taken in by a convincing invoice is not a personal failing. Speed matters more now than working out how it happened. This table follows the FTC's What To Do if You Were Scammed guide.

Clean up your Mac after a remote session

After a remote session, the job on a Mac is to cut the connection, remove what was installed and take back any permissions that were granted. The FTC's general advice is to update your security software, scan, and change passwords. These Mac steps go alongside that.

1. Turn off Wi-Fi and unplug any Ethernet cable. A remote session needs a connection, and this ends it while you work.
2. Delete any remote access app you didn't choose yourself, starting with anything installed during or right after the call. Apple's uninstall steps: check the app's folder for an uninstaller, otherwise drag it from Applications to the Trash.
3. Open System Settings > General > Sharing and turn off **Screen Sharing** and **Remote Management** unless you use them.
4. Go to Privacy & Security and review **Screen & System Audio Recording**, **Remote Desktop** and **Accessibility**. Turn off anything you don't recognize.
5. Check General > **Login Items & Extensions** and remove unfamiliar items.
6. Check General > **Device Management**. Remove a profile you didn't install. Apple warns about apps that install profiles to control your device.
7. Reconnect to the internet, install any pending updates from General > **Software Update**, then run a scan if you have security software.
8. From a different device if you have one, change your email, banking and Apple Account passwords, and turn on two-factor authentication.

A Mac from work is a different case. Remote Management and profiles may be there on purpose, so call your IT team first and leave those two alone. If you're not sure you've found everything, the FTC suggests going to the manufacturer, a trusted tech company or a knowledgeable friend. That's a good reason to book Apple Support yourself, through Apple's own site.

How to make the next fake invoice easier to spot

You can't stop your address landing on a scammer's list, but a few habits make a fake Geek Squad invoice much easier to dismiss.

• Know your subscriptions. I keep a short note on my Mac of what renews and where. When a notice names something that isn't on the note, the decision is already made.
• Never use a contact detail from a message about money. Go to the company's site yourself, every time. Best Buy and the FTC both say this.
• Give no one remote access because they contacted you first. Malwarebytes puts it flatly: never let someone connect to your computer remotely. Best Buy says it generally doesn't make unsolicited calls either.
• Keep macOS's app protections on. In Privacy & Security, **Allow applications from** controls where apps can come from. Don't relax it because someone on the phone tells you to.
• Harden the account that matters most. Your email resets everything else. If you use Gmail, our guide to using Gmail securely on a Mac covers passkeys and 2-Step Verification.
• Use a separate address for shops and sign-ups. I use one for anything I buy online, so a retailer invoice that turns up in my personal inbox looks wrong straight away. Our guide to throwaway addresses and aliases covers the options.