Fake Antivirus Subscription Renewal Email Scam Examples
An email formatted like an official receipt claims a large charge for antivirus or security software renewal has just gone through on your account, and provides a phone number to call if you did not authorize it. Calling connects you to a fake support agent who either talks you through a refund that actually transfers money out of your account, or asks for remote access to your computer to process the cancellation — during which they install malware or steal saved passwords and banking details. The large unexpected charge creates panic. Never call the number in the email; check your real bank or card statement instead.
Last reviewed: 1 June 2026
Sanitized example messages
Illustrative, sanitized examples. Personal details are replaced with placeholders such as [phone number] and [fake link].
Thank you for your [Security Software] renewal. Your account has been charged [amount] for a 3-year plan. To cancel or dispute this charge, call [fake number] within 24 hours.
Your [Security Software] subscription has auto-renewed for [amount]. If you did not authorise this, contact our billing team immediately at [fake number]. Reference: [fake order ID].
Invoice #[fake number]: [Security Software] 5-Device Premium Plan — [amount] charged to your account. Not you? Call [fake number] to receive a full refund.
IMPORTANT: [Security Software] annual renewal of [amount] has been processed. To opt out of future renewals or request a refund, call our 24/7 line: [fake number].
What the scammer wants
To get you to call a fake number where agents will either walk you through a 'refund' process that actually drains your bank account, or gain remote access to your computer to steal credentials and data.
Red flags in the message
- You receive a charge confirmation for software you do not recognise or did not buy
- The email urges you to call a phone number rather than log into your account
- The sender email address is not the official software company domain
- The agent asks you to download remote-access software to process your refund
- Agent instructs you to open your bank account on-screen to verify the refund
- The invoice amount is unusually high to maximise panic
A safe response
Do not call the number in the email. Check your bank and card statements directly — if no charge appears, the email is entirely fake. If you use the named software, log into the real website to manage your subscription.
What not to send
- Remote access to your computer
- Bank login credentials
- Confirmation of any on-screen bank transfer
What to do if you already replied
- If you gave remote access, disconnect from the internet and run a legitimate security scan
- If you transferred money, contact your bank immediately and report the fraud
- Change passwords for banking and email accounts that may have been visible
Evidence to preserve
- Screenshot the full message or call details
- Note the sender number, email, or profile
- Save any links (without clicking) and payment details
- Record dates and times
Frequently asked questions
I called the number and they asked to remote into my computer — what should I do?
Disconnect from the internet or shut down the computer immediately, and don't follow further instructions. Afterwards, run a trusted antivirus scan, change your important passwords from a different, uncompromised device, and contact your bank if any financial software was open during the session.
I gave them my bank login during the refund process — how bad is this?
This is serious — contact your bank immediately to report the login as compromised, and ask them to monitor or freeze the account and reverse any unauthorized transactions. Change your online banking password right away from a different device if possible.
The email had a legitimate-looking invoice number and company logo — how can it be fake?
Scammers routinely copy real company branding, logos, and invoice formatting, so visual polish alone doesn't confirm authenticity. Check your actual bank or card statement for the charge rather than trusting the email, and contact the software company through its official website if unsure.
How do I check if I really have an antivirus subscription with this company?
Log in to your account on the software provider's official website, typed directly rather than through any link in the email, and check your billing history there. You can also check your bank or card statement for the company's real charges.