The Fake Renewal Email: When "Your Antivirus Renewed" Is a Scam
"Your Geek Squad protection has been renewed for $499.99. Call 1-800-xxx to cancel." Emails like this (also dressed up as Norton, McAfee, Microsoft, or "your auto warranty") are one of the most common scams aimed at older adults, because they exploit two real things: people do buy antivirus subscriptions, and people do fear being charged. The trap is the phone number in the email. This page is how to check the truth without calling it.
the email is the door, the phone call is the theft
The fake renewal check
An email can claim anything. The only way to know if a subscription renewed is to check the account the parent actually has, logged in the normal way, never by calling the number in the email.
- RecognizeSpecifics are fake confidenceA dollar amount and invoice number, a phone number to call to cancel (the tell), urgency ("your card will be charged in 24 hours"), and a receipt with a slightly wrong domain.
- The five-minute checkDo not call, do not clickNothing in the email needs an immediate answer. Log in to the company's real website or app yourself; if there is no account with that company, the email is fiction, full stop.
- The billing sectionThe account is the truthReal subscriptions show their status, the next charge date, and a real cancel button. If the account shows no such subscription, there was no charge.
- If the parent calledCalling is not the disaster, the call isNever give a "refund agent" remote access, never buy gift cards to reverse a charge, and if codes, card details, or money moved, follow the compromised-account response in order.
The rule, in one sentence: an email can claim anything. The only way to know if a subscription renewed is to check the account you actually have, on the company's real website, logged in the normal way. Never call the number in the email.
Why this scam works so well on parents
The fake renewal email is a two-act scam. Act one: the email claims a charge, with a phone number to "cancel." Act two: the person calls, and the "refund agent" on the other end walks them through installing remote-access software, "checking" their bank, or buying gift cards to reverse the charge. The email is just the door; the phone call is where the money is actually taken.
It works on parents for three reasons: they are more likely to have real antivirus or warranty subscriptions (so the story is plausible), they are more afraid of being overcharged than of being scammed, and they have been raised to call the number on the bill. Every one of those instincts is what the scammer is betting on.
What the fake email looks like
- A specific dollar amount and an invoice number. "Your renewal for $499.99 was processed. Invoice #88231." The specifics are fake confidence.
- A phone number to call to cancel. This is the tell. Real companies cancel in your account settings or through their published support number, which is never "call this number in this email to get a refund."
- Urgency. "Your card will be charged in 24 hours" or "refund window closes today." The deadline is the pressure.
- A receipt that looks official but has a slightly wrong domain in the reply-to or the links (hover, don't click).
How to check the truth in five minutes
- Do not call the number in the email. Do not click the links. Nothing in the email needs an immediate answer, no matter what it says.
- Log in to the account yourself. Go to the company's real website (type the address, or use the app you already have) and sign in the normal way. If you have no account with that company, the email is fiction, full stop.
- Look at the actual billing section. Real subscriptions show their status, the next charge date, and a real cancel button. If the account shows no such subscription, there was no charge.
- If you genuinely cannot tell, call the company's real support number from its actual website (not from the email) and ask: "Did you charge me?" That is the verification habit from How to verify a message independently, applied to email.
The script to teach a parent
Print this and keep it near the computer:
If your parent already called the number
Calling is not the disaster; the disaster is what the call leads to. Work through this in order:
- If they only talked, nothing is lost yet. But watch for the follow-up: the fake agent will call back. Tell your parent the calls are part of the scam and to let them ring.
- If they installed remote-access software (AnyDesk, TeamViewer, "GoToAssist", or anything the agent told them to download), the agent may have been on their computer. Disconnect the internet, uninstall the software if possible, and treat every account as potentially seen. Start with Your parent's account was hacked: the 60-minute response.
- If they gave a card number, call the card issuer now and tell them the card may be compromised. Cancel and reissue. Do not wait for a mystery charge to appear.
- If they paid with gift cards or a wire, that money is usually gone, but report it anyway (FTC and IC3), and read Your parent sent money to a scammer. Now what? for the full recovery order.
Report the email itself: forward it to reportfraud.ftc.gov or use the FTC's tech support scam reporting page.
How to make the next one fail
- Set up one shared rule: "We never call numbers from emails about money. We check the account, or we ask." One sentence, printed, works better than any filter.
- Turn on two-factor authentication on the email and bank accounts, so a stolen password is not enough. See Two-factor authentication for parents.
- Use the scam-risk tool: paste a suspicious email into Scam Risk Check and get a risk band before acting on it.
- Agree that remote-access software is never installed by anyone who called or emailed first. Real support never needs it unsolicited.
Related
- The fake invoice scam: when the same unexpected charge is presented as a bill.
- The fake tech support scam: when the message turns into a demand for computer access.
- How to verify any message independently: the call-back method this page builds on.
- Impersonation scams: bank, utility, tech-support, and government costumes.
- Your parent sent money to a scammer. Now what?: if the call went further than a conversation.
- The package delivery text scam: the same trick, arriving by text.
Sources
- FTC: How to spot, avoid, and report tech support scams (retrieved August 2026)
- FTC: How To Avoid a Scam (retrieved August 2026)
Found an error? Report it.