Published:
February 16, 2026
•
12
min read
•
By
Patrick Coughlin
.png)
You open your email and see a message that looks urgent: "Your Norton subscription has been renewed for $349.99. Call now to cancel." Your heart races. You don't remember ordering this. You didn't authorize any charge. And now you're worried money is about to disappear from your account.
Take a breath. This is almost certainly a scam—and you're not alone in receiving it.
Fake antivirus renewal emails and pop-ups are one of the most common tech support scams targeting people today. These messages impersonate trusted brands like Norton, McAfee, and Microsoft to create panic and push you into calling a fake "support" number. Once you call, scammers use psychological tactics to gain access to your computer and, ultimately, your money.
The good news: these scams follow predictable patterns, which means you can learn to spot them. This guide will show you exactly what to look for, what happens if you engage with scammers, and what to do if you've already been targeted.
A fake antivirus renewal scam starts with an email, pop-up, or phone call claiming that your antivirus subscription has been renewed—or is about to expire—and that you'll be charged a large sum unless you take immediate action.
The message typically includes:
The goal is simple: make you panic and call the number. The scammer is counting on your desire to talk to a human to 'sort it out'. Once you do, the real scam begins.
The person who answers sounds professional and helpful. They'll typically send you a new email or send you to a site to "download software" so they can "verify your account" or "process your refund." This software gives them "remote access" to control your computer. From there, they may steal personal information, install malware, or execute the devastating "overpayment refund" trick that has cost some victims tens of thousands of dollars.
Scammers choose to impersonate these brands because they're household names. Norton, McAfee, and Microsoft are software that millions of people recognize even if they don't currently have an active subscription. The familiarity creates just enough doubt: "Wait, did I sign up for this? Do I have this on my computer?"
Scammers know that many people, especially those who aren't deeply familiar with their computer's software, may not remember exactly what security programs are installed. This uncertainty, combined with fear of losing money, pushes people to call.
These aren't small-time crimes. According to the Federal Trade Commission's 2024-2025 report on protecting older consumers, Americans 60 and older reported losing $159 million to tech support scams in 2024 alone. Adults in this age group were five times more likely than younger adults to have their money stolen by these schemes.
These statistics aren't meant to frighten you. They're meant to show that these scams are widespread, sophisticated, and worth taking seriously.
Here's an example of what a fake antivirus renewal email might look like:
From: Norton Billing <billing@n0rton-secure.com>
Subject: Your Norton™ Subscription Has Been Renewed - Invoice #NRT-2025-84729
Dear Valued Customer,
Thank you for renewing your Norton 360 Premium subscription.
Order Details:
This amount will be debited from your account within 24-48 hours.
If you did not authorize this transaction or wish to cancel and receive a full refund, please contact our Billing Department immediately:
📞 Call Now: 1-888-XXX-XXXX (Toll-Free)
Our support team is available 24/7 to assist you.
Thank you,
Norton Billing Team
Red flags in this example:
Some scams don't arrive by email—they appear as alarming pop-ups, or fake alerts, while you're browsing the web. These warnings may claim:
These pop-ups often try to prevent you from closing the browser window, making it seem like your computer is frozen or infected.
Here's what a fake pop-up might look like:
⚠️ CRITICAL SECURITY ALERT ⚠️
Your McAfee Protection Has Expired!
Your computer is at IMMEDIATE RISK of:
Call our Security Experts: 1-800-XXX-XXXX
WARNING: Do not close this window. Your computer may be infected.
Red flags:
Important: If you encounter a pop-up like this, don't call the number. You can usually close these by pressing Ctrl+Alt+Delete (Windows) or Command+Option+Escape (Mac) to force-quit your browser.
These pop-ups get triggered by malicious links embedded in advertisements on legitimate sites or when you visit a malicious site designed to actually trigger this full-screen pop-up.
When you call the number on a fake antivirus email or pop-up, you'll reach someone who sounds professional, patient, and eager to help. They may introduce themselves with a common-sounding name and claim to work for Norton, McAfee, or Microsoft support.
The conversation typically follows this pattern or scam script:
With remote access, the scammer can see everything on your computer—your files, your browser, your email, and most dangerously, your bank accounts if you log in.
This is where the scam becomes truly devastating.
Once connected to your computer, the scammer may ask you to log into your bank account "to verify the refund went through." While you're watching, they claim to process your refund—but then pretend something went wrong.
"Oh no," they say. "I accidentally deposited $34,000 instead of $349. This is a huge mistake. I could lose my job. Can you please check your account?"
They may even manipulate what you see on screen—editing the HTML of your bank's website to show a fake balance increase. In reality, no money was deposited. But under pressure and wanting to help, some victims have transferred their own savings to "return" money that was never actually sent.
Scammers specifically request payment methods that are difficult or impossible to reverse:
The FBI has noted a recent trend of scammers instructing victims to mail cash in packages. Once sent, recovery is essentially impossible.
No legitimate company will ever ask for payment via gift cards or cash shipments. If someone asks for this, it is always a scam.
.png)
Knowing what to look for can protect you from falling for these scams. Here are seven warning signs:
Look carefully at the "From" address. Scammers use domains that look similar to real companies but contain subtle differences:
Legitimate emails from Norton come only from @norton.com or @nortonlifelock.com. McAfee uses @mcafee.com. Microsoft uses @microsoft.com.
Phrases like "Act within 24 hours," "Immediate action required," or "Your account will be charged" are designed to prevent you from thinking clearly. Legitimate companies don't threaten you with urgent deadlines for routine billing matters.
Emails that begin with "Dear Customer," "Dear User," or "Valued Member" rather than your actual name are suspicious. Companies you have accounts with typically know your name and use it.
Real renewal notices direct you to log into your account through the company's website. Scam emails prominently display phone numbers because the scammers need you to call them to execute their scheme.
If the "renewal charge" seems surprisingly high—$349, $499, or even $599—that's intentional. Higher amounts create more panic and urgency. Actual Norton and McAfee subscriptions typically cost between $30 and $150 per year, depending on the plan.
While scammers have improved with AI, many fake emails still contain awkward phrasing, spelling errors, or inconsistent formatting. Legitimate companies have professional communications teams that agonize over the wording in these emails and rarely make errors.
Any email or pop-up that eventually leads to requests to download software or require urgent bank access, wire transfers, gift cards, or cash is a scam. No legitimate company operates this way no matter how real the person on the end of the line sounds.
Before doing anything else, look at the full email address—not just the display name. Hover over or click on the sender's name to reveal the actual address.
Legitimate domains include:
Scammers like to add extra words to the domain, replace letters with similar-looking numbers (a 0 instead of O, a 1 instead of an l), and other small changes that are difficult to see at first glance.
Never click links in an email you're unsure about. Instead:
If there's no record of the charge mentioned in the email, the email is fake.
If you want to speak with someone, find the company's phone number on their official website—not from the email. For reference:
The best thing to do is to forward the email to submit@scamwise.com or take a screenshot of the pop-up and submit it on Scamwise.com, a free tool to help people check suspicous messages.
If you've already interacted with a scam email or call, don't panic—but do act quickly. The steps you take now can limit the damage. And please know: falling for a sophisticated scam doesn't mean you did anything wrong. These criminals are professionals who manipulate and socially engineer millions of people every year.
If you called but didn't download any software or share personal information:
Scammers often call victims back, sometimes pretending to be from a "different department" or claiming there's a new urgent issue. Don't answer calls from numbers you don't recognize and stay vigilant. Consider a service offered by savisecurity.com or others that will help block/filter scams before they reach you.
If you installed AnyDesk, TeamViewer, UltraViewer, or similar software and gave someone access:
Immediately:
After you've done that, you can check your computer for:
If you're not comfortable doing this yourself, consider having a trusted family member help or taking your computer to a reputable local repair service.
If you logged into your bank account while a scammer had remote access or if you took action with your bank based on the scammer's guidance:
Immediately:
Also:
Banks have fraud departments specifically trained to help in these situations. They've seen this before and can guide you through next steps.
This is the most difficult situation to recover from, but there are still steps to take:
For wire transfers:
For gift cards:
For cash sent via mail or shipping:
Recovery of funds is often difficult, but reporting is important. Your report helps law enforcement track these criminal operations and may help prevent others from becoming victims.
If you're a caregiver or adult child of aging parents, having a conversation about scam awareness can be one of the most protective things you do. Here are some tips:
Start with empathy, not alarm:
Make it collaborative:
Normalize asking for help:
Set up practical protections:
You don't need expensive antivirus software to stay protected:
Many cybersecurity experts note that for most home users, the built-in protections plus safe browsing habits are sufficient.
Reporting scams helps law enforcement track criminal operations and may prevent others from becoming victims. Here's where to report:
The FTC collects reports on scams and uses them to build cases against fraudsters.
How to report:
The FBI's Internet Crime Complaint Center handles online fraud, including tech support scams.
How to report:
Major companies track scams that impersonate their brands:
Most likely, it's a scam—especially if:
To be certain, log into your Norton account directly at norton.com (not through any links in the email) and check your subscription status. If there's no pending charge, the email is fake.
You'll reach a scammer pretending to be tech support. They'll likely:
If you've already called but haven't downloaded software or shared information, hang up and block the number. If you've gone further, see the "What to Do If You Already Engaged" section above.
Yes. With remote access to your computer, scammers can:
This is why you should never give remote access to anyone who contacts you unsolicited.
If you're not confident handling this yourself, ask a trusted family member for help or take your computer to a reputable local repair service.
Receiving a fake antivirus email can be unsettling, especially when it's designed to look so convincing. But now you know the warning signs: suspicious sender addresses, urgent deadlines, inflated prices, and requests to call phone numbers instead of logging into your account.
Remember:
If you've been targeted by one of these scams, you're in good company—millions of people receive these emails every day. What matters is how you respond.
When in doubt, pause. Check directly with the company through their official website. And don't hesitate to ask a trusted friend or family member for a second opinion.
Trust your instincts, verify before you act, and remember: it's always okay to hang up, delete the email, and ask for help.
Got a suspicious-looking renewal email? Check it with Scamwise.
Ask Scamwise — it's free
Patrick Coughlin
Patrick Coughlin is a cybersecurity and technology expert with over two decades of hands-on experience at the intersection of technology, intelligence, and security. He has built teams, products and companies to protect governments and Fortune 500 enterprises from the most sophisticated cyber threats. When his mother was targeted with an AI-powered impersonation scam, the threat became personal. His debut book, Dark Side of the Boom, reveals the human cost of the growing AI-powered scam economy, explores the organized criminal networks and black-market engines that power it and offers clear-eyed strategies for how to better prepare and protect ourselves and our communities. Patrick is the co-founder and CEO of Savi Security and lives in Los Angeles with his wife, son and dog.
Seniors lost $4.9 billion to phone scams in 2024. Learn why scammers target elderly adults and discover compassionate ways to protect aging parents without undermining their independence.
4 min read
Learn how scam calls work, why caller ID spoofing makes them convincing, how scammers use AI and voice cloning, and steps to protect yourself from phone fraud.
4 min read
Upload any suspicious message for a free, instant scam check.
Try Scamwise — it's free
