Part of our Scam Spotlight series — plain-language breakdowns of specific phishing and scam patterns we see, building on our Understanding Spam and Phishing Emails (Basics) article.
You receive what looks like a routine invoice, receipt, or payment notice from a vendor, software company, or service you may or may not actually use. It often includes a real-looking invoice number and total, along with a link or attachment to “view,” “pay,” or “dispute” the charge. Some versions instead claim a payment already went through and ask you to click a link if you didn't authorize it — designed to make you click out of alarm rather than suspicion.
A common variation skips the link entirely, or includes one alongside a phone number to call to “dispute,” “cancel,” or “correct” the charge. This version can feel even more convincing, because instead of a suspicious link, you're talking to a real, live person who sounds professional and reassuring. That person is the scammer — and their entire job on the call is to walk you through “verifying your identity” or “processing your refund” while actually getting you to read off your card number, CVV code, online banking login, or a one-time verification code sent to your phone or email.
Subject: Invoice #48213 Payment Confirmation
From: Billing Department <billing@cloudservice-invoices.net>Your subscription has been renewed for $649.99. If you did not authorize this charge, click below within 12 hours to dispute and receive a full refund.
[ Dispute This Charge ]
Or call our billing department directly at 1-855-0142 to cancel and receive your refund.
Thank you for your business.
On the call, the “representative” will usually sound calm and professional, ask you to “confirm your identity” by reading out your full card number and CVV code, or ask you to open your online banking app and read back a one-time code they claim they need “to process the cancellation.” That code is actually being used in real time to log into your account or authorize a transaction on their end.
A vague or unfamiliar sender domain that doesn't match any company you actually use.
An oddly large, specific dollar amount designed to prompt an immediate, worried click.
A short dispute window (“within 12 hours”) meant to rush you past careful thinking.
No account details you'd recognize — no order number tied to something you remember buying, no last-4 of a real card.
The only ways offered to “fix” the problem are clicking their link or calling their number — never a suggestion to check your account directly.
A phone number provided right in the email, rather than a number you'd find yourself by looking up the company independently.
Once on the phone, being asked to read out a full card number, CVV code, or a one-time verification code — a real company can look up your account without needing you to recite this information, and no legitimate refund or cancellation ever requires a one-time code sent to your own phone or email.
Don't click the link or open any attachment.
Don't call the phone number in the email either. A number sitting right in the suspicious message is just as untrustworthy as a suspicious link — it usually connects you straight to the scammer.
Check your actual account or bank statement directly by logging in to the real company's website (typed in yourself, not from the email) or checking your bank/credit card app.
If you don't recognize the company at all, it's almost certainly fake — delete it or mark it as spam.
If you do use that service and are unsure, contact them using the phone number or website listed on your last legitimate bill or their official site — never a number from this email.
If you do end up on a call and the person asks you to read out a card number, CVV code, banking login, or any one-time verification code, hang up. No legitimate refund, cancellation, or dispute process ever needs this.
Forward suspicious invoices to abuse@usfamily.net to help us block the sender.
If you clicked the link and entered payment or account information:
Contact your bank or card issuer immediately to flag possible fraud and consider requesting a new card number.
If you entered any email or account passwords on the linked page, change them right away — see How Do I Change My Email Password?
Keep an eye on your statements for unauthorized charges over the following weeks.
If you called the number and spoke with someone:
If you're still on the call, hang up now.
If you read out your card number and CVV code, contact your bank or card issuer immediately to flag the card for fraud and request a replacement.
If you read out a one-time verification code that was sent to your phone or email, assume the related account (banking, email, or otherwise) may be compromised — log in yourself right away and change the password, or contact that provider directly to secure it.
Don't trust anything the caller told you, including any “case number,” promised callback, or claim that the issue is “resolved” — verify everything independently through the real company.
Understanding Spam and Phishing Emails (Basics)
Scam Spotlight: 'CEO Fraud' Wire Transfer Requests
My Email Bounced Back — What Do I Do?