It usually looks like a receipt. Thank you for your order: a laptop, a phone, a year of antivirus, somewhere between a few hundred and a couple of thousand dollars, charged to an account in your name. Underneath is a phone number and a line telling you to call straight away if you did not make the purchase.
You did not make the purchase. Nobody did. The receipt is the bait and the phone number is the trap.
Scamwatch, run by the National Anti-Scam Centre, put out an alert on these fake purchase callback scams in July 2026, and the pattern is worth knowing by heart. As a tech support business, the part that worries us most is where the call ends up: with a stranger connected to your computer.
How it reaches you
The message can arrive as a text, an email, an app notification or even a calendar invitation. It borrows names you already trust. Scamwatch lists fake PayPal invoices, Apple iMessage texts, Norton and McAfee renewal emails, Microsoft subscription notices, Shop app order receipts and Google Meet invitations among the versions reported.
Some include your real name, email address, phone number or home address. That does not make them genuine. Personal details like these circulate widely after data breaches, so a message knowing your name proves nothing about who sent it.
The amount is chosen with care. Scamwatch says the fake purchase is often between $300 and $2,000: large enough to make your stomach drop, small enough to be believable. And there is always a clock. Call now, before the payment goes through.
What happens if you call
The person who answers is friendly, calm and very keen to help you cancel the order. According to Scamwatch, from there the call tends to go one of four ways:
- They ask for your bank or card details so they can "process the refund".
- They claim they have refunded you too much by mistake and ask you to send the difference back.
- They talk you through installing software so they can "fix it for you", which gives them control of your device and a view of your accounts.
- They ask you to help catch the scammers by buying gift cards and sending photos of them.
The third one is the most damaging. Once someone has remote access to your computer, they can watch you log in to your bank, move money while keeping you talking, and leave software behind for later.
Three checks that shut it down
Do not call the number in the message. Do not reply to it or tap any link in it either. Everything in that message was written by the person trying to rob you, including the phone number.
Check the real account yourself. Open the PayPal, bank or Apple app you normally use, or type the website address in by hand, and look at your actual transactions. If the purchase is not there, it does not exist.
If you still want to speak to someone, find the number yourself. Use the company's official website or the back of your bank card. Never a number supplied by the message.
A real receipt does not need you to phone anyone. That one sentence is worth teaching to everyone in the family, especially parents and grandparents.
If you have already called
No judgement. These calls are run by people who do this all day, and they are good at it. What matters is the next ten minutes.
- Hang up. You do not owe them an explanation.
- If you installed anything or let them onto your screen, turn off Wi-Fi or unplug the internet cable on that computer and stop using it for banking.
- Call your bank from a different phone, using the number on the back of your card, and tell them exactly what happened.
- Change your email and banking passwords from a different device, not the one they touched.
- Report it to Scamwatch, even if you did not lose money. Reports are how the alerts get written.
Then work through our guide on what to do in the next hour, which covers the rest in order.
The short version
Unexpected receipt, big number, phone number to call, pressure to hurry. That combination is the scam. Close the message, check your real account, and carry on with your day.
If someone has already been on your computer and you want it checked and cleaned properly, our trusted local technicians come to your home or office across Australia. Book a HelloTech technician and we will make sure nothing was left behind.
