What's going on
You get an email that looks like a receipt. It says your Norton or McAfee antivirus subscription has been automatically renewed and your account has been charged £349.99, sometimes £499.99. There's an invoice number, a transaction date, and a phone number to call if you want to cancel and get a refund. The email looks official. The logo looks right. The amount is high enough to make you act fast.
The whole thing is fake. There is no subscription. There is no charge on your account. But when you ring that number to "cancel", you get through to someone who sounds like a real support agent. They ask for remote access to your computer to "process the refund". Once they're in, they go after your bank account. Which? has repeatedly warned about these fake antivirus emails impersonating Norton and McAfee. They are one of the most common scams in the UK right now.
What these scams look like
The emails follow a pattern. They use real brand names, real looking invoices, and amounts big enough to worry you. Here are the most common versions doing the rounds.
"Norton renewal" email
The most common version. A fake invoice saying Norton 360 has been renewed. The amount is always high enough to make you panic but not so high it feels completely unbelievable.
"Thank you for renewing your Norton 360 Total Protection. Your payment of £349.99 has been successfully processed. If you did not authorise this transaction, please call our billing department immediately on 0800 XXX XXXX to request a full refund."
"McAfee auto renewal" email
Same trick, different brand. Claims McAfee Total Protection has been renewed. Often includes a fake order number and a "24 hour cancellation window" to pressure you into ringing quickly.
"Your McAfee Total Protection subscription has been auto renewed. Amount charged: £499.99. Order ID: MCF-29847561. If this was not you, contact our support team within 24 hours on 0203 XXX XXXX to cancel and receive a full refund."
"Geek Squad" renewal email
A variant using the Best Buy Geek Squad brand. Less common in the UK since Best Buy pulled out, but these still land in inboxes. The unfamiliar brand actually makes some people more likely to call, because they're confused about why they're being charged.
"Your Geek Squad subscription has been renewed for £299.99. This charge will appear on your statement within 3 to 5 business days. To dispute or cancel this charge, call our team on 0800 XXX XXXX."
"Refund overpayment" call
Sometimes the scammer rings you back after an initial email. They say they've processed your refund but accidentally sent too much and need you to return the difference. They haven't sent anything. They manipulate what you see on screen to make it look like they have.
"We've processed your refund of £349.99 but our system accidentally transferred £3,499.99 to your account. I could lose my job over this. Could you please transfer the difference of £3,150 back to us?"
How the scam works
This scam is different from most because the victim makes the call. You ring them. That makes it feel like you're in control. You're not. Here's what happens, step by step.
1. The fake invoice email
An email arrives that looks like a payment confirmation from Norton, McAfee, or another antivirus company. It contains an invoice for £349.99 or more, a fake order number, and a phone number to call if you want to cancel. The email is designed to make you feel like money has already left your account. It hasn't. But the panic of seeing a large unexpected charge is enough to make most people pick up the phone.
Why it works
Most people have heard of Norton and McAfee. Many have used them at some point. The email doesn't ask you to click a dodgy link. It gives you a phone number. That feels safer. And because you're the one making the call, it doesn't feel like a scam.
2. You call them
You ring the number in the email expecting to reach Norton or McAfee support. Someone answers. They sound professional. They confirm the "charge" on your account and say they can process a cancellation and full refund right now. They just need to connect to your computer to verify the transaction and complete the process. It sounds reasonable.
The trick you don't see
- • You called them, so you trust the interaction
- • They use hold music and transfer scripts to sound like a real call centre
- • They already know the "invoice" details because they sent the email
- • They never ask for money at this stage, only "access to help you"
3. Remote access
They talk you through downloading TeamViewer, AnyDesk, or UltraViewer. Once connected, they can see your screen and control your mouse. They'll ask you to log in to your online banking so they can "verify the refund has gone through". While you're watching, or while they distract you, they move money out of your account. Some scammers black out your screen so you can't see what they're doing at all.
What they actually do while connected
They access your online banking and transfer money to accounts they control. They look through saved passwords in your browser. They install hidden software so they can reconnect later. Some edit the HTML on your banking page to make it look like a refund has arrived when it hasn't.
4. The "overpayment" trick
If the direct theft doesn't work, they try something else. They edit your banking screen to make it look like they've accidentally refunded you £3,499.99 instead of £349.99. They act panicked. They say they'll lose their job. They beg you to transfer the "extra" £3,150 back. You feel sorry for them. You send the money. But they never sent you anything in the first place. Your real balance hasn't changed. The number on screen was faked. Over £1 billion was stolen by fraudsters in the UK in 2024 according to UK Finance, and tricks like this are a big part of the reason why.
Who falls for this
This scam catches people who would normally be careful. The reason is simple: you're not answering a random call from a stranger. You're ringing what you think is a real company to sort out a billing problem. You initiated the contact. That changes the whole dynamic. Your guard is down because you feel like you're in charge of the situation.
Older people are disproportionately affected, but this one catches younger victims too. If you've ever had a subscription you forgot to cancel, you know that sinking feeling when an unexpected charge appears. Scammers are banking on that exact reaction. The NCSC has warned that fake subscription emails are among the most reported phishing attempts in the UK.
What makes it convincing
- • You make the call, so it doesn't feel like a scam
- • The email uses real brand names and logos
- • The invoice looks genuine with order numbers and dates
- • The "support agent" sounds calm and professional
- • They never ask for money upfront, just "access to help"
What should make you stop
- • You don't have a Norton or McAfee subscription
- • The email came from a Gmail or random address, not the company
- • They want you to download remote access software
- • They ask you to log in to your online banking
- • No legitimate company processes refunds through remote access
If you get one of these emails
Do not call the number
This is the single most important thing. The phone number in the email connects to the scammers. It does not go to Norton, McAfee, or any real company. If you want to check whether a subscription exists, go directly to the company's real website and log in to your account there.
Check your bank account
Log in to your banking app or online banking directly. Do not use any link from the email. Look at your recent transactions. You will almost certainly find that no payment for antivirus software has been taken. That confirms the email is a scam.
Forward the email to the NCSC
Send it to [email protected]. The National Cyber Security Centre collects these reports and uses them to take down scam infrastructure. It takes 30 seconds and it genuinely helps.
Forward phishing emails to [email protected]. The NCSC uses these reports to block scam websites and email addresses.
Report to Action Fraud
Call 0300 123 2040 or report online at actionfraud.police.uk. Even if you didn't lose money, your report helps Action Fraud track the scale of these operations.
Delete the email
Once you've reported it, delete it. Don't click any links in it. Don't download any attachments. Don't reply to it. Mark it as spam so your email provider can filter similar messages in the future.
Already given them access?
If you've already called the number and let them connect to your computer, act now. Speed matters here.
-
1
Disconnect from the internet immediately
Turn off your WiFi or pull out the ethernet cable. This cuts the remote connection instantly. If they're still connected to your machine, this stops them from doing anything else. Do this before anything.
-
2
Call your bank straight away
Use the number on the back of your debit or credit card, or dial 159 (the UK's Stop Scams helpline). Tell them what happened. They can freeze your accounts, block pending transactions, and set up monitoring for suspicious activity. Do this from your phone, not from your computer.
-
3
Uninstall the remote access software
Remove TeamViewer, AnyDesk, UltraViewer, or whatever they had you download. Go to your installed programs list and look for anything you don't recognise. If you're not sure, take the computer to a trusted local repair shop and explain what happened.
-
4
Change your passwords from a different device
Use your phone or a tablet to change passwords for your email, online banking, and any other accounts you used while the scammers were connected. Start with your email, because if they can access that, they can reset passwords for everything else.
-
5
Run a full virus scan
Once you're back online, run a full scan using Windows Defender (already on your PC) or download Malwarebytes (free). Do a full scan, not a quick one. This picks up keyloggers and other hidden software they may have installed while connected.
-
6
Report to Action Fraud
Call 0300 123 2040 or go to actionfraud.police.uk. You'll get a crime reference number. Keep it. You'll need it if you make a claim to recover your money through your bank or card provider.
The short version
Red flags
- • Email invoice for antivirus software you never bought
- • Charges of £300 to £500 for Norton, McAfee, or Geek Squad
- • A phone number to call for a "cancellation" or "refund"
- • They ask you to install remote access software
- • They want you to log in to your online banking while connected
What to do
- • Do not call the number in the email
- • Check your bank account directly for any real charges
- • Forward the email to [email protected]
- • Report to Action Fraud (0300 123 2040)
- • If they connected, disconnect and call your bank on 159