Users continue to receive emails referencing payment receipts for anti-virus solutions they did not purchase. Unlike from invoice scams, these emails do not request payment but rather claim that a payment has already been made (see the above image for reference). The user is instructed to contact the company via the included phone number to manage or cancel their subscription. Those who call the “cancellation department” will likely be asked to verify their payment card or banking account information in order to cancel their subscription and be refunded. If provided, the threat actors behind the phishing campaign steal the user’s financial information, which can be used to pilfer their funds and make fraudulent purchases. The techniques used in this and similar scams may increase the threat actors’ success rate as users are often more likely to attempt to receive a refund if they believe they have been charged erroneously. For any further questions contact us here at Cyber Command.