Subscription Auto-Renewal Warning Email Scam Examples
This email impersonates a software or streaming company, warning that an expensive subscription is about to auto-renew and inviting you to call a number to cancel and get a refund. The scammer's real goal isn't the fake charge — it's getting you on a live call, where agents fabricate a refund process requiring remote-access software, then use that access to move real money out of your bank account. The lever is loss aversion around an unwanted large charge. Never call a number from an unsolicited renewal email; check your subscription and billing directly through the app or service's official site instead.
Last reviewed: 1 June 2026
Sanitized example messages
Illustrative, sanitized examples. Personal details are replaced with placeholders such as [phone number] and [fake link].
RENEWAL NOTICE: Your [software] annual subscription of [amount] will be charged to your card on file in 24 hours. To cancel and receive a full refund, call [fake number] immediately.
Action required: [streaming service] Premium — [amount] auto-renewal. If you did not authorise this, call our billing team at [fake number] to dispute the charge before it posts.
Your [antivirus] licence renewal of [amount] has been processed. If this is an error, contact our refund department within 24 hours: [fake number]. Do not contact your bank as this may delay your refund.
What the scammer wants
To get you on the phone where agents fabricate a refund process, gain remote access to your device via screen-sharing, and then steal money directly from your bank account.
Red flags in the message
- Renewal amount that seems far too high for any software or streaming service
- Urgency to call a number rather than manage the account online
- Warning not to contact your bank
- Email from a free domain or an address that does not match the brand
- No link to the official account portal to cancel
A safe response
Do not call the number. Log in to the service directly using the official website to check your subscription status. If in doubt, contact the company via details on their official site.
What not to send
- Remote-access software credentials
- Online banking login details
- Card or bank account information by phone
What to do if you already replied
- If you installed remote-access software, close it immediately and run a security scan
- If you shared banking details, contact your bank's fraud line now
- Change passwords for any accounts accessed during the call
Evidence to preserve
- Screenshot the full message or call details
- Note the sender number, email, or profile
- Save any links (without clicking) and payment details
- Record dates and times
Frequently asked questions
I called the number and let them install remote access software — what do I do now?
Disconnect your device from the internet immediately and turn it off, then have someone knowledgeable remove any remote-access software before reconnecting, or take it to a professional if unsure. Contact your bank right away to freeze the account and check for unauthorized transactions, since remote access can be used to move money directly.
Is the subscription charge in the email even real?
Usually not — check your actual subscription status and billing history directly inside the app or on the service's official website, not through the email. If there genuinely is a subscription, you can cancel it through your account settings without ever needing to call anyone.
I gave them my bank login during the 'refund' call — what's the risk?
This is serious, since it can allow them to view balances and potentially initiate transfers depending on what access was granted. Change your online banking password immediately from a different device and call your bank to explain what happened and review recent activity.
Can I get money back if they moved it out of my account?
It depends on the payment method and how quickly it's reported — contact your bank directly and explain exactly what happened, since banks have specific fraud processes for remote-access scams. Report the incident to your national fraud reporting service as well, as this helps investigations even if recovery isn't guaranteed.