Norton and McAfee renewal scams: spot a fake invoice

Scammers copy Norton and McAfee because millions of people use it. Here's how to tell a fake Norton and McAfee message from a real one, and what to do if you already clicked.

Two older men working something out together on a laptop
Photo: Centre for Ageing Better / Unsplash

In short

Most common fake: Invoice saying your antivirus subscription renewed for hundreds of dollars.

Safest check: Check the sender address: real Norton emails come from domains such as @norton.com, and McAfee lists its real sender addresses on mcafee.com.

Where to report it: Forward fake Norton emails as an attachment to spam@norton.com.

Example · fake Norton and McAfee messageIllustrative, links disabled
Norton LifeLock: Your annual subscription has been renewed. Amount charged: $449.99. If you did not authorise this, call our cancellation desk within 24 hours: +1 (855) 555-0192. Order ID: NL-7734-2291
An example fake Norton and McAfee message with the warning signs highlighted.

What Norton and McAfee says

Norton says its real emails never ask for passwords, Social Security numbers or card details, and they will not try to start remote access to your device out of the blue. McAfee says it will never make you call a phone number from an email or text, never call to charge you for customer service, and never ask for your SSN or passwords. Source: Norton

Common fake Norton and McAfee messages

These are the 5 shapes a fake Norton and McAfee message usually takes. They are listed in the order we see them most often, and none of them is something Norton and McAfee itself does.

  1. Invoice saying your antivirus subscription renewed for hundreds of dollars
  2. Order confirmation with a phone number to call to cancel
  3. Pop-up warning that your computer is infected and your protection has expired
  4. Refund offer that needs remote access to your computer
  5. Email from a free webmail address using the Norton or McAfee logo

Norton and McAfee's real web addresses

Genuine Norton and McAfee links and emails use these domains. Look at the part just before the first single slash: norton.com is real, but norton-support-center.com or norton.com.account-check.top are not.

  • norton.com
  • nortonlifelock.com
  • mcafee.com

Scammers can also hide a fake link behind real-looking text. Learn how to read a web address.

How to check a Norton and McAfee message safely

  1. Check the sender address: real Norton emails come from domains such as @norton.com, and McAfee lists its real sender addresses on mcafee.com
  2. Sign in to your Norton or McAfee account yourself to see your actual subscription
  3. Do not call numbers in the message or allow remote access
  4. Look for a real charge on your bank or card statement

How to report a fake Norton and McAfee message

Also report it to the official fraud service in your country. See the worldwide list.

If you clicked, paid or shared details

Act quickly. It makes a difference.

  1. If you entered card or bank details, call your bank now using the number on your card, and ask them to block the card.
  2. If you entered a password, change it at norton.com, typed into your browser yourself, and turn on two-step verification. Do not use any link from the message.
  3. Expect follow-up calls or messages pretending to help, sometimes claiming to be from Norton and McAfee security. Never share one-time codes and never move money to a "safe account".
  4. Forward fake Norton emails as an attachment to spam@norton.com, then delete the message.

More help: Tech support and remote-access scams and what to do after a scam.

How to protect yourself next time

Keep security software with web protection on your devices

It blocks many known scam and malware websites and warns about dangerous apps. That matters most if you installed an app or "support" tool someone asked you to.

Free: Keep your phone and browser updated, and leave Google Play Protect or Microsoft Defender switched on. Both are free.

  • Bitdefender Partner link Security suite for phone and computer with web and scam protection.

Use a password manager

It only fills in your password on the real website, so a look-alike login page gets nothing. It also makes a different password for every account, so one leak doesn't open the rest.

Free: Bitwarden has a free plan, and even the password manager built into your phone or browser beats reusing one password everywhere.

  • NordPass Partner link Password manager with a free plan and a family plan for up to six people.

Compare the tools that help, and what each costs

Links marked Partner link may earn us a commission, at no cost to you. It never changes our advice, and the free option always comes first. Affiliate disclosure.

Questions people ask

Does Norton and McAfee send messages asking for payment or personal details?

Norton says its real emails never ask for passwords, Social Security numbers or card details, and they will not try to start remote access to your device out of the blue. McAfee says it will never make you call a phone number from an email or text, never call to charge you for customer service, and never ask for your SSN or passwords.

How can I check if a Norton and McAfee message is real?

Check the sender address: real Norton emails come from domains such as @norton.com, and McAfee lists its real sender addresses on mcafee.com. Sign in to your Norton or McAfee account yourself to see your actual subscription. Do not call numbers in the message or allow remote access. Look for a real charge on your bank or card statement.

How do I report a fake Norton and McAfee message?

Forward fake Norton emails as an attachment to spam@norton.com. Send fake McAfee emails or content to scam@mcafee.com. Report the scam to the Federal Trade Commission at ReportFraud.ftc.gov.

I clicked a link in a fake Norton and McAfee message but did not enter anything. Am I at risk?

Opening a link is far less serious than filling one in. Close it, and if you need your account, reach it by typing norton.com yourself. Clicking does tell the sender your number is live, so expect more messages for a while: forward fake norton emails as an attachment to spam@norton.com.

Was this page helpful?

Have you had this one?

Tell other people what the message said and how it reached you. It helps someone recognise it before they tap.

Leave out your own phone number, email and bank details. A person reads every comment before it appears. Phone numbers and web addresses are hidden when it's published. Scammers pretend to be real companies, so a company named in a comment is almost always being impersonated, not accused. See our privacy notice.

Official sources and further reading

We check our pages against official advice from the organisations themselves and from government agencies.