Antivirus Renewal Scam Emails: How to Spot Fake Norton, McAfee and Malwarebytes Invoices (2026)

If you own a Norton, McAfee or Malwarebytes subscription, you have probably received at least one email that looked like this: “Your antivirus has expired. Your card has been charged $349.99. Call this number within 24 hours to cancel.” Most of those messages are not from the antivirus company at all. They are antivirus renewal scam emails, and in 2026 they are one of the most common ways US households and small businesses lose money to fraud. This guide shows you how to tell a real renewal notice from a fake one, what to do if you already clicked, and how to make sure your subscription is handled only through channels you control.

Why antivirus renewal emails are such a popular scam

Scammers pick antivirus brands for three reasons. First, almost everyone recognizes the names Norton, McAfee and Malwarebytes, so the message feels plausible even to people who do not currently use that product. Second, real antivirus renewals genuinely are expensive, so a surprise charge of $200 to $500 sounds believable. Third, the fake “invoice” creates panic: you did not authorize this, your money is at risk, and the only way to fix it is to call the number or click the link right now.

The goal is rarely to sell you anything. The goal is to get you on the phone or onto a fake website, where the scammer will ask for remote access to your computer, your bank login “to process the refund”, or gift card numbers “to verify your identity”. None of that is how a legitimate software company works.

The 8 signs of a fake antivirus renewal email

1. The sender address does not match the brand

Look past the display name. A message that says “Norton Billing” but comes from an address ending in gmail.com, outlook.com, or a random domain such as secure-billing-center.net is fake. Real notices come from the vendor’s own domain, for example norton.com, nortonlifelock.com, mcafee.com or malwarebytes.com. On a phone, tap or long-press the sender name to reveal the real address.

2. It contains an invoice or receipt for something you never bought

Scam emails almost always attach a PDF “invoice” or paste a receipt into the body with a large round amount, an invoice number and a product you may not even own. Genuine renewal receipts reference the exact plan on your account, the last four digits of the card you actually have on file and your real account email. If you cannot find that subscription when you sign in to your account, the receipt is fake.

3. It pushes you to call a phone number

This is the clearest tell. The vendor’s own renewal emails link to your account page; they do not beg you to call a toll-free number to “cancel within 24 hours”. A phone number in a billing email is the scammer’s whole business model: once you call, a friendly agent will ask to connect to your computer.

4. Urgency and fear in the subject line

Subject lines such as “Final Notice”, “Your protection has ended”, “Payment failed – action required today” or “Your computer is infected” are designed to make you act before you think. Legitimate renewal reminders are calm and usually arrive weeks before the term ends.

5. Generic greeting and sloppy formatting

“Dear Customer” or “Dear User” instead of your name, inconsistent fonts, stretched logos and spelling errors are all red flags.

6. The link does not go where it says

Hover over any button or link on a computer, or long-press it on a phone, and read the real destination. A link that shows norton.com but points to a long string of letters on an unrelated domain is a phishing link. Never type your password on a page you reached from an unexpected email.

7. It asks for payment in gift cards, wire transfer or cryptocurrency

No antivirus company has ever asked a customer to pay or receive a refund in Apple, Google Play or Target gift cards. If a “refund agent” asks you to buy gift cards or to log in to your bank while they watch, hang up and disconnect.

8. You do not actually have that subscription

Many people who receive a “McAfee renewal” never had McAfee. Scammers send millions of these messages and rely on a small percentage of recipients being confused. If you know you use a different product, or you bought a one-year retail key and never saved a card, the email is simply spam.

How a real renewal works

When you buy a retail license key, such as the ones sold on Infinity Solutions, you redeem it in your own account on the vendor’s website. The vendor emails you a reminder from its own domain before the term ends. If you saved a payment method and left auto-renewal on, the charge appears on your card statement with the vendor’s name, and the receipt sits in your account history. If you turned auto-renewal off, nothing is charged; you simply buy a new key and apply it. Our guide on stopping auto-renewal and paying less for antivirus walks through both options.

Notice what is missing from that process: no phone calls, no remote access, no gift cards and no PDF invoices from strangers.

What to do if you receive one of these emails

1. Do not click, call or reply. Replying confirms your address is live and invites more mail.
2. Check your real account. Open a new browser tab, type the vendor’s address yourself (for example my.norton.com or home.mcafee.com), sign in and look at Subscriptions and Billing. If there is no matching charge, there is no charge.
3. Check your card statement. Scam emails describe charges that never happened. A quick look at your bank app settles it.
4. Report and delete. Use your mail provider’s “Report phishing” option, then delete the message. In the United States you can also forward it to the FTC at ReportFraud.ftc.gov.

What to do if you already clicked or called

Do not feel embarrassed; these campaigns are built to catch careful people on a busy day. Work through this list in order.

• If you gave someone remote access: disconnect from the internet, restart the computer, uninstall any remote-control app you did not install yourself (AnyDesk, TeamViewer, UltraViewer, Supremo and similar), then run a full scan with a trusted product. Our checklist on testing whether your antivirus is actually working helps you confirm protection is active afterwards.
• If you typed a password: change it immediately on the real site, and on any other account that shared the same password. Turn on two-factor authentication.
• If you shared card or bank details: call the number on the back of your card, report the fraud and ask for a replacement card.
• If you bought gift cards: contact the card issuer right away with the card numbers and receipts; some can be frozen if reported quickly.
• If money left your account: file a report with your bank and with the FTC. Keep the scam email as evidence.

How to keep your real subscription scam-proof

A few habits remove almost all of the risk.

Know where your keys come from. Keep the delivery email for every license you buy. Genuine keys from a store like ours are redeemed on the vendor’s site and show up inside your account with the product name and expiry date; our guide to spotting a genuine antivirus license key explains what to check before and after you buy.

Decide how you renew. Either leave auto-renewal on with a card you monitor, or turn it off and buy a fresh retail key each year. Mixing the two is what creates confusion when a fake “receipt” lands in your inbox.

Bookmark the real account page. Always reach your antivirus account from your own bookmark, never from a link in an email, even one that looks right.

Use the vendor’s own support. Norton, McAfee and Malwarebytes publish their support channels inside your account and on their websites. If a key will not activate, follow our activation walkthrough for the major brands or contact the store you bought from; a reputable seller will exchange or refund a key that does not work rather than ask you to pay again.

Keep protection current. Modern security suites block most phishing pages before they load. If your subscription really has lapsed, a genuine one-year key for a known product costs far less than the fake invoices claim, and it is delivered by email within minutes of ordering. You can compare current options on our antivirus guides page.

Real renewal notice vs. scam email at a glance

Frequently asked questions

Does Norton or McAfee ever call customers about renewals?

Not out of the blue. These companies communicate through your account and email reminders from their own domains. An unexpected call claiming to be from an antivirus company, especially one asking for remote access or payment, should be treated as a scam.

I received a renewal receipt but I never bought the product. Was my card charged?

Almost certainly not. The receipt is the bait. Check your bank or card statement directly; if there is no charge, there is nothing to cancel and the email can be deleted.

What if the email is actually from the real vendor?

Then you will find the same information when you sign in to your account by typing the address yourself. Use the account page, not the email, to review or cancel anything.

Can antivirus software block these emails?

Security suites with web protection block many phishing links and fake payment pages, and most mail providers filter a large share of the messages. No tool catches everything, which is why knowing the signs above still matters.

Is it safe to buy a license key from a reseller instead of renewing?

Yes, when the seller is transparent. A genuine retail key redeems on the vendor’s own site, shows the correct product and term in your account, and comes with a written refund promise if it fails to activate. That is how every key sold by Infinity Solutions works.

Who should I report an antivirus scam email to in the US?

Report it to your email provider using the phishing button and to the Federal Trade Commission at ReportFraud.ftc.gov. If you lost money, also contact your bank and local police.