The £79.99 Panic Email: Checking an Antivirus Renewal You Never Asked For

Christmas inboxes are busy enough without a bill for security software you never bought. Yet every winter, fake antivirus renewal emails and browser pop-ups do the rounds, often dressed up as a final warning before your protection supposedly expires. The aim is simple: make you panic, then make you call a number or pay an invoice that has nothing to do with any real product.

The bill for something you would remember buying

Here is a realistic version. The email lands at 7:42am, just before the school run. The subject line says: 'Payment declined - your antivirus renewal is on hold.' Inside, there is a neat invoice layout, a logo that looks close enough to the real thing, and an amount of £79.99. An order ID sits next to a renewal date of today. At the bottom, a phone number is printed in bold, with a line urging you to call within 24 hours to avoid interruption.

If you have never bought that product, your first thought might be that someone has used your card. That is exactly the reaction the sender wants. Some versions include a PDF attachment; others are plain text with a link to a fake billing portal. A browser pop-up variant may fill the screen with red warnings and a phone number, claiming your device is infected or your subscription has lapsed.

Why it feels believable

Antivirus is one of those things people buy and then forget about. Households often have security software bundled with a laptop, broadband package or mobile contract, so a renewal email does not sound impossible. A fake invoice with an order number, a VAT-style layout and a realistic amount can slip past the part of your brain that would normally spot a scam.

The timing does a lot of the work. In the run-up to Christmas, people are already buying subscriptions, renewing domains, sorting insurance and ordering gifts. A payment query feels plausible because there are so many real payments flying about. The deadline adds pressure, and the phone number turns an email into a conversation. Once you call, the script can move quickly: confirm your card details, download a remote-access tool, or make a bank transfer to 'cancel' the renewal.

That last part is the one to watch. A genuine software company does not need remote access to your computer to discuss a subscription. If someone asks you to install TeamViewer, AnyDesk or a similar tool so they can 'check your account', treat it as a fraud attempt until you have verified everything through official channels.

The five-minute check

You do not need to become a forensic expert. You need a routine that slows the moment down.

1. Do not use the contact details in the email. Open the vendor's official app or website yourself, by typing the address or using a saved bookmark. Look under billing, subscriptions or renewals. If there is no active plan and no payment due, close the email. If you are unsure, contact support through the official site, not through the email.

2. Treat browser pop-ups as adverts, not notices. A web page cannot reliably tell you that your antivirus has expired or that your device is infected. Close the tab. On Windows, Alt+F4 will usually close the active window; on a Mac, Cmd+W closes the tab. Do not call the number on screen. If the browser keeps showing notifications, clear the site permissions in the browser settings.

3. If you have already shared card details, use your bank's safeguards. Open the banking app, check pending transactions and freeze the card if the app allows it. Then call the number on the back of your card or use the in-app chat. Say clearly that you think you have been caught by a fake invoice. Your bank can stop the card, watch the account and talk you through the next steps.

4. Report it, even if you did not lose money. In the UK, report fraud and cybercrime to Action Fraud online or on 0300 123 2040. Forward suspicious emails to [email protected], the NCSC's Suspicious Email Reporting Service. Keep the sender address, the phone number and a screenshot. Those details help take the same campaign off other people's screens.

5. If remote access was installed, act quickly. Disconnect the device from the internet, remove the remote-access software, and change important passwords from a different, trusted device. Run a security scan. Then call your bank, because saved passwords and card details may have been visible. If it was a work laptop, tell your employer's IT or security contact straight away.

If you already picked up the phone

Do not panic, and do not feel silly. These scripts are designed to sound official and urgent. If you gave card details, call your bank and ask for the card to be stopped. If you made a bank transfer, contact your bank immediately and ask about a recall. If you installed remote software, assume the caller may have seen files and saved passwords until you have checked.

Keep a short record: time of call, number displayed, what you shared and what you changed. That helps your bank and Action Fraud. It also helps you spot follow-up scams, because criminals often pass details to another team who call again pretending to be the bank's fraud department.

A household rule worth pinning up

Security software renews in the app or account page, not through an email that arrives out of the blue. If a message says your protection ends today, open the official app and look for yourself. If the app says nothing is due, the email is almost certainly junk. Tell the rest of the household the same rule, especially anyone who pays the bills or looks after the family laptop. A five-minute check is far cheaper than a £79.99 invoice for software nobody owns.