Antivirus renewal scams have become increasingly sophisticated, often starting with a message that claims your subscription has been automatically renewed. Following the provided instructions to cancel may lead you to a counterfeit page designed solely to harvest your personal information. In reality, the renewal charge is nonexistent.
It’s essential to note that receiving a message that mentions your antivirus software does not imply that the sender has gained access to your device or account. Scammers frequently impersonate well-known brands and distribute identical messages to a wide audience, banking on the fact that some recipients will indeed be customers.
As previously highlighted, responding to a scam message can inadvertently increase the value of your contact information. By confirming that your number is active and that you are willing to engage, you provide scammers with even more data: your name, email address, phone number, and an indication that you might respond to a call regarding a fictitious antivirus payment.
These details can be sold to other fraudsters or used to initiate the next phase of the scam: a phone call from someone attempting to convince you to install remote access software or assist them in reversing a payment that never occurred.
A closer look at a fake Avast site
During our investigation into these scams, we encountered a renewal scam site impersonating Avast, specifically targeting users in Belgium. This site was notably more polished than typical scam pages and exhibited several indicators of having been crafted with AI assistance.
The fraudulent page claimed that your Avast Premium Security subscription had renewed for €129.99, covering five devices, and would renew again the following February. It featured a green tick, an “Active” status badge, and a neatly organized summary table detailing the amount, payment method, and dates.
However, none of this was genuine. There was no actual subscription or charge, and the page had no affiliation with Avast, which was being impersonated without authorization.
Written in French for a Belgian audience, the page included a cancellation form requesting your full name, email address, and Belgian mobile number, but omitted any request for sensitive information such as passwords or card details. This design choice may have been intentional; a form asking only for basic contact information can appear innocuous and is easier for potential victims to fill out. A valid mobile number linked to a real name is precisely what scammers need for their next move: contacting the victim under the guise of support staff.
The signs of AI involvement
The page’s code contained two notes intended for the creator, written in polite French, indicating that the form was not yet functional and that a real submission process would need to be integrated later. These notes resembled a contractor’s handover of an incomplete project rather than a reminder left by a scammer, reflecting the courteous tone often associated with AI-generated content.
Additional clues suggest that AI played a role in the page’s development. The code contained unused styling for a section that had been removed, indicating that the page was constructed in stages without a final review. While the copy was grammatically correct, it lacked specificity, discussing the benefits of the subscription without mentioning any particular Avast features, such as its firewall, VPN, or ransomware protection.
The page was never finished
The comments in the code reveal that the form on this page was non-functional. Someone created a convincing counterfeit, successfully executing the challenging aspects, but halted before linking the form to a data submission endpoint.
Other indicators in the code imply that the page had not been tested in a browser, as two pieces of text would have displayed as nonsensical gibberish if they had been viewed. What we observed was likely a half-finished project or a template awaiting a buyer who would add a destination for the stolen information.
Creating such a page used to require a certain level of skill, which limited the number of scams that could be produced. However, AI has lowered this barrier significantly. The creator could request versions in Dutch or German or tailor it to target an entirely different brand, all within minutes.
How to spot an antivirus renewal scam
Traditionally, the advice was to look for errors: poor grammar, incorrect currency, awkward layouts, or distorted logos. However, this guidance has become less effective, as AI can now generate fluent text and polished designs, while scammers can easily replicate authentic logos. A professional-looking page is no longer a reliable indicator of authenticity.
- Check whether you were charged. If a message claims a payment has been made, verify your bank or card statement directly. If the charge is absent, there is nothing to cancel.
- Check the subscription through the official app or website. Avoid clicking links in the message. Instead, access the company’s app or website independently to verify your account status and upcoming payments.
- Be cautious of cancellation forms that primarily request your phone number. Legitimate cancellations typically occur within your account, and a company you already pay should know how to contact you.
- Treat any follow-up calls as potential threats. If you filled out a form like this, you may receive a scam call afterward. You are under no obligation to answer or engage.
- Do not install remote access software for someone who calls you. This action can grant them control over your device, jeopardizing your accounts, passwords, and financial security.
If you have already engaged in a call and installed software, disconnect the device from the internet, remove the application, and change your passwords from a different device. If you have shared financial information, contact your bank immediately.
Block and check suspected scams
The most effective defense is to prevent scam pages from loading in the first place. Malwarebytes Browser Guard is a complimentary extension available for Chrome, Edge, Firefox, and Safari, designed to block malicious websites, phishing attempts, and scam advertisements before they can inflict harm.
If you are uncertain whether something is a scam, share a screenshot, message, phone number, or link with Scam Guard. It can analyze the information in seconds and provide guidance on the next steps. Scam Guard is integrated into Malwarebytes Premium Security for Windows, Mac, iOS, and Android.
If you receive a call after submitting a form like this, enter the number into Malwarebytes Scam Number Check to determine if it has been associated with scam activities.
AI helps scammers build convincing antivirus renewal pages
Antivirus renewal scams have become increasingly sophisticated, often starting with a message that claims your subscription has been automatically renewed. Following the provided instructions to cancel may lead you to a counterfeit page designed solely to harvest your personal information. In reality, the renewal charge is nonexistent.
It’s essential to note that receiving a message that mentions your antivirus software does not imply that the sender has gained access to your device or account. Scammers frequently impersonate well-known brands and distribute identical messages to a wide audience, banking on the fact that some recipients will indeed be customers.
As previously highlighted, responding to a scam message can inadvertently increase the value of your contact information. By confirming that your number is active and that you are willing to engage, you provide scammers with even more data: your name, email address, phone number, and an indication that you might respond to a call regarding a fictitious antivirus payment.
These details can be sold to other fraudsters or used to initiate the next phase of the scam: a phone call from someone attempting to convince you to install remote access software or assist them in reversing a payment that never occurred.
A closer look at a fake Avast site
During our investigation into these scams, we encountered a renewal scam site impersonating Avast, specifically targeting users in Belgium. This site was notably more polished than typical scam pages and exhibited several indicators of having been crafted with AI assistance.
The fraudulent page claimed that your Avast Premium Security subscription had renewed for €129.99, covering five devices, and would renew again the following February. It featured a green tick, an “Active” status badge, and a neatly organized summary table detailing the amount, payment method, and dates.
However, none of this was genuine. There was no actual subscription or charge, and the page had no affiliation with Avast, which was being impersonated without authorization.
Written in French for a Belgian audience, the page included a cancellation form requesting your full name, email address, and Belgian mobile number, but omitted any request for sensitive information such as passwords or card details. This design choice may have been intentional; a form asking only for basic contact information can appear innocuous and is easier for potential victims to fill out. A valid mobile number linked to a real name is precisely what scammers need for their next move: contacting the victim under the guise of support staff.
The signs of AI involvement
The page’s code contained two notes intended for the creator, written in polite French, indicating that the form was not yet functional and that a real submission process would need to be integrated later. These notes resembled a contractor’s handover of an incomplete project rather than a reminder left by a scammer, reflecting the courteous tone often associated with AI-generated content.
Additional clues suggest that AI played a role in the page’s development. The code contained unused styling for a section that had been removed, indicating that the page was constructed in stages without a final review. While the copy was grammatically correct, it lacked specificity, discussing the benefits of the subscription without mentioning any particular Avast features, such as its firewall, VPN, or ransomware protection.
The page was never finished
The comments in the code reveal that the form on this page was non-functional. Someone created a convincing counterfeit, successfully executing the challenging aspects, but halted before linking the form to a data submission endpoint.
Other indicators in the code imply that the page had not been tested in a browser, as two pieces of text would have displayed as nonsensical gibberish if they had been viewed. What we observed was likely a half-finished project or a template awaiting a buyer who would add a destination for the stolen information.
Creating such a page used to require a certain level of skill, which limited the number of scams that could be produced. However, AI has lowered this barrier significantly. The creator could request versions in Dutch or German or tailor it to target an entirely different brand, all within minutes.
How to spot an antivirus renewal scam
Traditionally, the advice was to look for errors: poor grammar, incorrect currency, awkward layouts, or distorted logos. However, this guidance has become less effective, as AI can now generate fluent text and polished designs, while scammers can easily replicate authentic logos. A professional-looking page is no longer a reliable indicator of authenticity.
If you have already engaged in a call and installed software, disconnect the device from the internet, remove the application, and change your passwords from a different device. If you have shared financial information, contact your bank immediately.
Block and check suspected scams
The most effective defense is to prevent scam pages from loading in the first place. Malwarebytes Browser Guard is a complimentary extension available for Chrome, Edge, Firefox, and Safari, designed to block malicious websites, phishing attempts, and scam advertisements before they can inflict harm.
If you are uncertain whether something is a scam, share a screenshot, message, phone number, or link with Scam Guard. It can analyze the information in seconds and provide guidance on the next steps. Scam Guard is integrated into Malwarebytes Premium Security for Windows, Mac, iOS, and Android.
If you receive a call after submitting a form like this, enter the number into Malwarebytes Scam Number Check to determine if it has been associated with scam activities.