Free, independent guides. Not official support for Norton, McAfee, Microsoft or any manufacturer.

Fake Norton or McAfee renewal emails: how to spot them

Scammers send fake invoices for antivirus renewals you never ordered, hoping you will phone them to "cancel". The real goal is remote access to your PC or your bank details.

Applies to
Emails, texts and PDF invoices claiming to be from Norton, McAfee or similar
Difficulty
Easy
Time
About 7 minutes
Updated

Quick answer

Do not phone the number, reply or open the attachment. Check your real subscription by typing the vendor's web address yourself and signing in, and look at your bank statement. If nothing matches, it is a scam: report it as phishing and delete it.

  1. Recognise the pattern

    Fake renewal messages usually have several of these:

    • An "invoice" or "order confirmation" for a large amount, often several hundred dollars, for a plan you did not buy.
    • A phone number and an urgent deadline to "cancel" or "get a refund".
    • A sender address from a free email service, or a company name that does not match the brand.
    • A PDF or image attachment instead of normal text, so spam filters cannot read it.
    • Odd product names, wrong spelling, or no mention of your actual name.

  2. Do not phone, reply or open attachments

    The phone number connects to the scammers, not to Norton or McAfee. On the call, they typically ask you to install remote-access software to "process the refund", then claim they refunded too much and ask you to send money back.

  3. Check your real subscription safely

    Type the vendor's address yourself, sign in to your account, and look at your orders and renewal settings. Then check your bank or card statement for a matching charge.

    If there is no matching order and no charge, the email is fake. If there is a genuine renewal you do not want, the official account page explains how to turn off auto-renewal and request a refund under the vendor's current terms.

  4. If you already called or let them connect

    • Hang up and disconnect the PC from the internet.
    • Uninstall any remote-access program they asked you to install, from Settings, then Apps, then Installed apps.
    • Run a full scan and an offline scan.
    • From a different device, change your email and banking passwords.
    • If you shared card or bank details or sent money, call your bank using the number on the back of your card.

  5. Report it

    • Use your email app's Report phishing or Report junk option.
    • US: report it at ReportFraud.ftc.gov.
    • UK: forward the email to report@phishing.gov.uk.

  6. Delete it and block the sender

    Once reported, delete the message and block the sender. Expect more attempts: scammers reuse lists of addresses, and the brand names change from Norton to McAfee to Geek Squad or PayPal.

Did this guide solve it?