# Fake antivirus renewal emails: how to tell if a Norton or McAfee renewal is real

URL: https://iblockspam.com/blog/fake-antivirus-renewal-scam-emails
Last updated: 2026-10-12
Published: 2026-10-12
Topic: Phishing & threats
Author: iBlockSpam Team

> How to tell a fake Norton, McAfee or Geek Squad renewal email from a real one, check your actual subscription in minutes, and stop these scams at work.

## Short answer

A fake antivirus renewal email claims your Norton, McAfee or Geek Squad subscription renewed for hundreds of dollars and tells you to call a number or click a link to cancel. It's a scam if the charge isn't on your card statement or in your account on the vendor's own site. Never use the email's phone number, link or attachment.

"Your subscription has been renewed. If you did not authorize this payment, contact our billing team within 24 hours." Emails like this arrive in personal and work inboxes alike, often for a product the recipient has never bought. This guide shows how to tell a fake antivirus renewal from a real one, how to check your actual subscription in a few minutes, and how a business can keep these emails from turning into a costly phone call.

## What is a fake antivirus renewal email?

A fake antivirus renewal email is a scam message that pretends your security software subscription has renewed or is about to renew, usually for a few hundred dollars, so you'll contact the sender to "cancel." The [FTC](https://consumer.ftc.gov/articles/how-spot-avoid-and-report-tech-support-scams) says scammers "send notices about automatic renewals for tech support subscriptions," and "use the names of well-known companies like Geek Squad, McAfee, and Norton." The message "says you must call a phone number within 24 hours if you want to dispute the charge."

It's a form of tech support scam. The FBI's Internet Crime Complaint Center (IC3) recorded 47,794 Tech/Customer Support complaints in 2025, with reported losses of $2,134,675,818, according to its [2025 Annual Report](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf). People aged 60 and over reported more than $1.04 billion of those losses. Not every complaint began with an email, and the IC3 doesn't count fake renewals separately, but the FTC names them as one of the ways tech support scammers make contact.

The phone-call version has its own name, callback phishing. Our guide to [callback phishing](https://iblockspam.com/blog/callback-phishing-phone-scam-emails) explains what happens on the call, from remote access to the fake "overpayment" refund. This guide focuses on the email itself and on proving whether a renewal is real.

## What does a fake antivirus renewal email look like?

Most fake renewals follow a template. Here is an example built from the patterns the FTC describes. It is not a real message.

```
From: Norton Billing <billing.dept.4471@gmail.com>
Subject: Order Confirmation #NT-88231-US - Auto Renewal Successful

Dear Customer,

Your Norton 360 Deluxe (5 Devices, 3 Years) subscription
has been renewed successfully.

Amount: $449.99      Payment: Auto-debit
Renewal date: 10/12/2026

If you did not authorize this renewal, call our
Cancellation Desk within 24 hours: +1 (8XX) XXX-XXXX
```

The common variants:

- **Phone number only.** The classic callback lure, with no link to scan.
- **"Renew now" link.** Leads to a fake checkout or sign-in page that collects your card or password. The FTC warned in 2018 that [phishers send fake invoices](https://consumer.ftc.gov/consumer-alerts/2018/02/phishers-send-fake-invoices) while posing as a well-known tech company, and tell you to click a link if you didn't authorize the purchase.
- **Invoice attachment.** The text sits in a PDF or image so filters can't read it. See [PDF phishing attachments](https://iblockspam.com/blog/pdf-phishing-attachments).
- **Real payment-service invoice.** A genuine invoice or money request sent through a payment platform, with a note telling you to call. It passes authentication because the platform really sent it.

## How can you tell a real antivirus renewal from a fake one?

A real renewal notice sends you to your account on the vendor's own website or app; a fake one pushes you to a phone number, link or attachment in the email. The table below compares the details you can check without opening anything.

| Check | Genuine renewal notice | Fake renewal email |
|---|---|---|
| Do you own the product? | Yes, and you can find the purchase | Often a product you've never bought |
| Sender address | The vendor's own domain | Free webmail, a random domain, or a lookalike |
| Greeting | Usually your name | "Dear Customer" or your email address |
| How to cancel | Turn off auto-renewal in your account | "Call within 24 hours" or "click to dispute" |
| Amount | Matches the plan you bought | Large, odd amounts, often multi-year |
| Card statement | Shows the charge | Shows nothing |
| Authentication results | Passes SPF, DKIM and DMARC for the vendor's domain | Usually fails, or passes for an unrelated domain |

Two FTC lines are worth remembering. "Legitimate tech companies won't contact you by phone, email, or text message to tell you there's a problem with your computer." And if you think a renewal might be real, contact the company "using a phone number you know is real. Do not use the number included in the message."

### Read the sender, not the display name

The display name ("Norton Billing") is free text anyone can type. The address after it is what counts. If you're not sure how to see it, our guide to [display name spoofing](https://iblockspam.com/blog/display-name-spoofing) shows where to look on desktop and mobile. For a deeper check, paste the message headers into the [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer) and see which domain actually passed authentication.

## How do I check whether my antivirus subscription really renewed?

You can prove a renewal is fake in a few minutes without touching anything in the email.

1. **Don't call, click or open attachments.** Close the email.
2. **Check your card or bank statement**, in your banking app or by typing your bank's address. The FTC says that if you don't see a transaction for a tech support subscription, "that tells you the message was a scam." If you do see one you didn't authorize, ask your card issuer to reverse it.
3. **Check the vendor account yourself.** Type the vendor's address into your browser or open its app, sign in, and look at your subscriptions and auto-renewal setting.
4. **Check what's installed.** On Windows, open Windows Security, go to **Virus & threat protection**, and under **Who's protecting me?** select **Manage providers**, as [Microsoft describes](https://support.microsoft.com/en-us/windows/scan-an-item-with-windows-security-d1c8c01d-12ed-e768-cbb8-830ea8ccf8e6). If the product in the email isn't listed, you can't have been charged to renew it.
5. **Still unsure? Call the vendor** using a number from its official website, never the one in the email.
6. **Report and delete the email.** Use your mail app's report button, tell IT if it reached a work address, and report it at ReportFraud.ftc.gov.

Step 4 also answers a question many people have: do I even need this product? [Microsoft says](https://support.microsoft.com/en-us/windows/security/windows-security/windows-security-app-overview) Windows Security is "Built into Windows," and that if another antivirus app is installed and turned on, "Microsoft Defender Antivirus turns off automatically." Whether you keep a paid product is your choice. But knowing what you run makes these emails easy to dismiss.

## Why do people fall for fake renewal emails?

The scam is built around three pressures.

- **Money.** A charge of several hundred dollars makes people act before they think.
- **A deadline.** "Within 24 hours" leaves no time to check a statement.
- **Plausibility.** Auto-renewal is real, and many people half-remember buying security software years ago.

The FTC's [Geek Squad alert](https://consumer.ftc.gov/consumer-alerts/2022/10/how-recognize-fake-geek-squad-renewal-scam) describes texts and emails warning of a charge of "hundreds of dollars" to renew a membership. If you call, the scammer may ask for remote access, or ask for your bank details to "refund" you, then make it look as if they refunded you too much. Microsoft's own rule helps here too: "Error and warning messages from Microsoft never include a phone number," and "Microsoft doesn't send unsolicited email messages or make unsolicited phone calls to request personal or financial information," according to its [tech support scam guidance](https://support.microsoft.com/en-us/windows/protect-yourself-from-tech-support-scams-2ebf91bd-f94c-2a8a-e541-f5c800d18435).

## What should you do if you already called, clicked or paid?

Act quickly, and assume the scammer will try again.

| What happened | What to do first |
|---|---|
| You called but shared nothing | Hang up and block the number. Expect follow-up calls. |
| You gave card details | Call your card issuer using the number on the card and ask to cancel and reissue. |
| You entered a password on a fake page | Change it from a clean device, everywhere you reused it, and turn on two-factor authentication. |
| You allowed remote access | Disconnect from the internet. Microsoft says "consider resetting" the device, remove programs they installed, run a full scan and change passwords. |
| You sent money or gift cards | Contact your bank, payment app or the gift card issuer immediately, and report the loss at ic3.gov. |
| It was a work device | Tell IT straight away and don't try to clean it yourself. |

Our [callback phishing guide](https://iblockspam.com/blog/callback-phishing-phone-scam-emails) has a full IT checklist for remote access incidents, and [what to do after clicking a phishing link](https://iblockspam.com/blog/what-to-do-after-clicking-phishing-link) covers credential resets in more detail.

## How do businesses stop fake antivirus renewal emails?

A business stops these emails by making renewals irrelevant to staff and by filtering the obvious copies before they reach the inbox.

### Make the scam irrelevant

- **Manage endpoint security centrally.** If IT buys and deploys security software, no employee ever has a renewal of their own to worry about. Tell staff exactly that.
- **Centralize subscriptions.** Software renewals go to one billing contact or a shared purchasing mailbox, never to individual staff.
- **Publish one rule.** "We never renew or cancel anything by calling a number from an email." Put it in onboarding and in your [security awareness training](https://iblockspam.com/blog/email-security-awareness-training-small-business).
- **Block unapproved remote access tools.** If a scam call does happen, the attacker can't get in. The callback guide lists CISA's recommendations.

### Filter what you can

- **Content and reputation filtering.** Fake renewals are sent in bulk, reuse the same text and phone numbers, and often come from free webmail accounts that claim to be a well-known brand. Inbound filtering that looks at message content and sender reputation, not only links, catches many of them.
- **Brand-name rules.** A mail flow rule can tag or quarantine messages that mention a renewal for a security brand you don't use, especially from external senders. See [Microsoft 365 mail flow rules for security](https://iblockspam.com/blog/microsoft-365-mail-flow-rules-for-security).
- **External sender tags.** A visible "External" tag makes "Norton Billing" from a Gmail address stand out. See [Outlook external email tags](https://iblockspam.com/blog/outlook-external-email-warning-tag).
- **Easy reporting.** One-click reporting lets you find and remove the same email from every mailbox quickly.

No filter catches every version. A renewal with only a phone number, sent through a genuine invoicing platform, can pass every technical check. That's why the business rule matters as much as the filter. Our [how spam filters work](https://iblockspam.com/blog/how-spam-filters-work) guide explains why content-only scams are hard to score.

## Next steps

1. Check your own card statement and vendor account the next time a renewal email arrives, and never use the number in the email.
2. Tell your team who owns software renewals in your company and that no one cancels a subscription by phoning a number from an email.
3. Add a mail flow rule or quarantine policy for renewal notices that mention security brands you don't use.
4. Review what reaches your inboxes. The free [Email Health Check](https://iblockspam.com/tools/email-health-check) reviews your domain's setup, and iBlockSpam's [quarantine and digests](https://iblockspam.com/features/quarantine-and-digests) let users review held mail safely instead of finding it in the inbox.

Browse our other [phishing and threat guides](https://iblockspam.com/blog/topic/threats).

## Frequently asked questions

### Why did I get a Norton renewal email when I don't have Norton?

Because the email is almost certainly a scam sent in bulk. Scammers pick brands that millions of people recognize, so a share of recipients really do have the product and the rest may panic anyway. If you've never bought it, there's nothing to renew. Check your card statement, then delete and report the email.

### Do real antivirus renewal emails ask you to call a phone number to cancel?

A genuine renewal reminder points you to your account on the vendor's own website or app, where you can turn off auto-renewal yourself. The FTC describes fake notices that say you must call a number within 24 hours to dispute the charge. Any renewal email whose only way out is a phone number deserves suspicion.

### How can I see which antivirus is actually protecting my Windows PC?

Open the Windows Security app, go to Virus and threat protection, and under Who's protecting me? select Manage providers. Microsoft says Microsoft Defender Antivirus is built into Windows and turns off automatically when another antivirus app is installed and turned on, so this screen shows what you really run.

### What happens if I click the renew link in a fake antivirus email?

The link usually leads to a fake checkout or sign-in page that collects your card number, password or both, or it downloads a file. If you typed card details, call your card issuer using the number on the card. If you entered a password, change it from a clean device and turn on two-factor authentication.

### Can a spam filter block fake antivirus renewal emails?

It can catch many of them, especially bulk copies, brand names sent from free webmail accounts and known bad links. Versions with only a phone number, or sent through a genuine invoicing service, are harder because there's no malicious link or failed authentication to detect. Staff awareness covers the rest.

## Sources

- [FTC: How To Spot, Avoid, and Report Tech Support Scams](https://consumer.ftc.gov/articles/how-spot-avoid-and-report-tech-support-scams)
- [FTC Consumer Alert: How to recognize a fake Geek Squad renewal scam (October 2022)](https://consumer.ftc.gov/consumer-alerts/2022/10/how-recognize-fake-geek-squad-renewal-scam)
- [FTC Consumer Alert: Phishers send fake invoices (February 2018)](https://consumer.ftc.gov/consumer-alerts/2018/02/phishers-send-fake-invoices)
- [FBI IC3: 2025 IC3 Annual Report](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf)
- [Microsoft Support: Protect yourself from tech support scams](https://support.microsoft.com/en-us/windows/protect-yourself-from-tech-support-scams-2ebf91bd-f94c-2a8a-e541-f5c800d18435)
- [Microsoft Support: Windows Security app overview](https://support.microsoft.com/en-us/windows/security/windows-security/windows-security-app-overview)
- [Microsoft Support: Scan an item with Windows Security](https://support.microsoft.com/en-us/windows/scan-an-item-with-windows-security-d1c8c01d-12ed-e768-cbb8-830ea8ccf8e6)

## Free tools for this guide

- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [Email Health Check](https://iblockspam.com/tools/email-health-check): Grade your domain's MX, SPF, DKIM, DMARC and transport security in one scan.
- [Blacklist Checker](https://iblockspam.com/tools/blacklist-checker): Check an IPv4 or IPv6 address, or your mail servers, against public spam blocklists, with policy and delisting links.

---

Source: iBlockSpam, https://iblockspam.com/blog/fake-antivirus-renewal-scam-emails (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt