You receive an email saying your Norton 360 subscription has automatically renewed for $349.99 or your McAfee Total Protection plan has charged your bank account $299.00 — and if you want to cancel and get a refund, call the phone number in the email right now. The catch: this email is a scam. No charge has been made, Norton or McAfee did not send the email, and the phone number connects you to a criminal who will try to steal far more than the fake invoice amount. These fake antivirus renewal emails are among the most common scam emails circulating today and they catch hundreds of thousands of people every year. Here is exactly how the scam works and what to do.
How the Norton/McAfee Renewal Scam Works
The scam email arrives claiming to be an invoice or receipt for an antivirus subscription renewal. The amount is usually between $200 and $500 — high enough to seem alarming but plausible as an annual software subscription. The email looks professional, uses the Norton or McAfee logo and colour scheme, and includes a fake invoice number and date. At the bottom is a phone number labelled "To cancel and request a refund, call us at..." The urgency of seeing a large unexpected charge pushes people to call immediately without checking whether the charge is real.
When you call the number, you reach a scammer posing as Norton or McAfee customer support. From here the scam takes several routes. In the most common version, the "support agent" says they need to process your refund and asks you to allow remote access to your computer using a legitimate tool like AnyDesk or TeamViewer. Once connected, they navigate to your online banking page, claim to have "accidentally" refunded too much money, and ask you to send the "excess" back via gift cards, wire transfer, or cryptocurrency. The "excess" is fake — they have not deposited anything — but the money you send them is real and gone. In another variant they simply steal banking credentials or install malware while connected to your computer.
Red Flags in Every Fake Norton/McAfee Email
The sender address is almost never from norton.com or mcafee.com. Look at the actual address behind the display name: it will typically be a Gmail, Yahoo, Outlook, or randomly generated domain address. Real renewal emails from Norton come from @nortonlifelock.com or @norton.com. Real McAfee emails come from @mcafee.com. Anything else is a fake.
Real renewal receipts from Norton and McAfee do not contain a phone number to call for refunds. The phone number in the scam email is the entire mechanism of the fraud — without you calling it, they cannot steal anything. Legitimate companies handle subscription cancellations through your account portal or their official support website, not through a phone number printed in an invoice email.
Check whether you actually have a Norton or McAfee subscription. If you have never subscribed to that product, or your subscription does not auto-renew, the invoice is obviously fake. Even if you do have a subscription, the only way to verify whether a charge was made is to check your actual bank or credit card statement and your account portal on the real Norton or McAfee website — not to rely on an email that arrived in your inbox.
What to Do If You Received This Email
Do not call the phone number. Do not click any link in the email. Do not reply to the email. Check your bank account and card statement directly — if no charge has been made, delete the email and you are done. If you do see an unfamiliar charge on your statement, contact your bank directly using the number on the back of your card, not any number from the email. Report the scam email to the FTC at reportfraud.ftc.gov (US) or Action Fraud (UK).
Forward the email to spam@nortonlifelock.com if it impersonates Norton, or abuse@mcafee.com if it impersonates McAfee. These companies actively track phishing campaigns using their brands.
What to Do If You Already Called and Gave Access
If you allowed remote access: disconnect the computer from the internet immediately by unplugging the network cable or disabling Wi-Fi. Revoke the remote access session in AnyDesk or TeamViewer settings. Change the passwords on your email account and bank account from a different, uncompromised device. Contact your bank immediately to report potential fraud and freeze any accounts that were viewed during the session. Run a full malware scan with a reputable security tool — the scammer may have installed keyloggers or remote access backdoors. If money was transferred, report it to your bank, to the FTC (US) or Action Fraud (UK), and file a police report as this constitutes fraud.
Why Your Email Address Ends Up on Scam Lists
Scam operations targeting fake antivirus renewals buy or harvest email addresses from data breaches, public directories, and web scraping. The more places your real email address is registered, the more likely it is to appear in breach dumps that get sold to these operations. Using a disposable email address for website registrations you are not committed to limits the exposure of your real address. For services that require a real email — including your actual antivirus subscription — use your real address but with a strong unique password and two-factor authentication, as covered in two-factor authentication explained.
Frequently Asked Questions
Is the Norton/McAfee renewal email real?
Almost certainly not. These emails are a widespread scam. The real Norton and McAfee send genuine renewal notices too, but the scam version is far more common. Check the actual sender email address: real Norton emails come from @nortonlifelock.com or @norton.com, real McAfee emails from @mcafee.com. If the sender address is anything else, it is fake. Verify any supposed charge by checking your bank statement and your account on the actual Norton or McAfee website — not by calling a number in the email.
What happens if I call the number in the fake renewal email?
You connect to a scammer, not Norton or McAfee. They will attempt to gain remote access to your computer, steal your banking credentials, or trick you into sending money via gift cards or wire transfer under the pretence of processing a refund. Do not call the number. There is no legitimate reason to call a phone number printed in an invoice email to cancel a software subscription.
I gave them remote access. What should I do?
Disconnect from the internet immediately, then change your passwords and contact your bank from a different device. Run a malware scan on the compromised computer before reconnecting it to the internet. Report the fraud to your bank, the FTC (US) or Action Fraud (UK), and local police. Time matters — the sooner you contact your bank, the better the chance of recovering transferred funds.
How do I stop these emails from arriving?
You cannot stop scammers from sending them entirely, but you can reduce exposure by limiting where your real email address appears online. Use a disposable or alias address for sign-ups that do not require a permanent address. Check haveibeenpwned.com to see if your address has been in known data breaches — if it has, change the passwords on affected services and consider using an alias going forward.
Achyuth Kumar
Founder & editor, TempMailKit
Achyuth builds privacy tools and writes TempMailKit’s guides on email security, spam, and online privacy. Every article is checked against primary sources and our editorial policy before it is published. Questions or a correction? Get in touch.