Subscription Renewal Scam: Norton, McAfee, and Other Fake Alerts

The gift card extraction. Alternatively, the representative claims the refund can only be processed if you purchase gift cards (Google Play, Apple, or Steam) as a "verification method." You buy the cards, read the codes over the phone, and the money is gone.

The bank account drain. With remote access to your computer and visibility into your banking session, the scammer can transfer money between your own accounts (moving savings to checking, for example) and make it appear as if they deposited too much. They then convince you to "return" money that was yours all along.

Brands Most Commonly Impersonated

Norton and McAfee are the most frequently spoofed brands in subscription renewal scams because antivirus software is widely recognized but poorly understood by many users. Other commonly impersonated brands include:

Geek Squad (Best Buy), Microsoft Defender, Windows Security, PayPal, Amazon Prime, and various VPN services. The template is identical regardless of brand — an unexpected charge, a phone number to call, and a "refund" process that turns into theft.

How to Identify These Scam Emails

Check your actual bank statement. Before reacting to any "charge" notification, log into your bank account directly and check your recent transactions. If the charge doesn't appear on your statement, the email is fake.

Legitimate companies don't charge $349.99 without warning. Subscription renewals come with advance notice. You'll receive emails 30 and 7 days before renewal. An out-of-the-blue charge with no prior notification is almost certainly fabricated.

The phone number is the trap. Scam emails include a phone number because the scam requires human interaction. Legitimate companies handle disputes through their websites, apps, and official support channels — not through toll-free numbers embedded in one-off emails.

Check the sender address. Norton emails come from @norton.com or @nortonlifelock.com. McAfee emails come from @mcafee.com. Scam emails come from random addresses like norton-billing@invoice-services.com.

What to Do

Do not call the number in the email. Do not reply to the email. Check your bank statement to confirm no charge was made. If a charge does appear, dispute it through your bank's official fraud department, not through any number in the email. Delete the email or report it as phishing.

If someone you know has already called one of these numbers and given remote access to their computer, disconnect from the internet immediately. Change all banking passwords from a different device. Run a full malware scan. Contact your bank to report potential unauthorized access to your account. Check for unauthorized wire transfers or Zelle payments.

The subscription renewal scam is a call center operation. Somewhere in the world, rooms full of people are waiting for your panicked phone call. Don't give them the opportunity.