Avast Subscription Scam: $499.99 Renewal Invoices Lead to Support Fraud

An invoice says Avast Premium has renewed for $499.99, even though you do not remember buying it. The cancellation window is short, and a support number is printed where it is impossible to miss.

The Avast Subscription Scam does not require a real charge to create panic. The expensive renewal is bait for a conversation that can become much more costly.

Overview

The invoice is designed to trigger a callback

Fake Avast renewal messages commonly claim that an antivirus plan has been extended automatically for several years. The price may be close to $500, and the recipient is told to call quickly if the order was unauthorized.

Avast has publicly warned about a campaign using a $499.99 renewal claim and a telephone number for questions. The company found that the supposed invoice was not a real Avast sale.

The callback number belongs to fake support

The email may contain no useful payment button because the criminals want a live telephone conversation. Once called, an agent can adjust the story to the victim’s bank, device, and level of concern.

The caller may request card information, online-banking access, a refund form, or installation of remote-control software. None of those steps is required to verify whether a charge exists.

Refund help can become account theft

A simple invoice scam can branch into remote-access fraud, fake refunds, gift card demands, or unauthorized transfers. The criminal may claim a typing mistake caused too much money to appear in the victim’s account.

The operation may seek:

• Credit or debit card details for a fake cancellation
• Online-banking credentials and one-time passcodes
• Remote control of the victim’s computer
• Gift cards, cash, cryptocurrency, or wire transfers
• Email access and personal identity information
• Copies of documents displayed during screen sharing
• Additional payments disguised as refund corrections

The bank statement is more reliable than the invoice. If no matching charge exists, there is nothing to cancel through the number in the email.

What the Fake Avast Invoice Looks Like

The subject may mention renewal confirmation, payment receipt, subscription activation, or order completion. A sender name such as Avast Billing can appear even when the underlying email address is unrelated.

Inside, a table lists an invoice number, product name, term, quantity, and large total. The layout creates the impression that payment has already been approved.

The message often uses a generic greeting and says the amount will be debited within 24 hours. Poor grammar remains common, but a clean and professional document can be fraudulent too.

The most important feature is the cancellation number. The email repeatedly instructs the recipient to call instead of checking an authenticated account or reviewing the real payment statement.

Some versions attach a PDF. An attachment can carry only the fake invoice, but unexpected files should still be treated cautiously because other campaigns may include malicious content.

How the Avast Subscription Scam Works

Step 1: Criminals send fake invoices at scale

Email addresses are collected from breaches, purchased lists, scraped pages, or earlier scams. The message can be sent without knowing whether the recipient has ever used Avast.

Antivirus brands make effective bait because subscriptions and automatic renewals are familiar. A recipient may suspect an old trial or forgotten family purchase.

Step 2: A large renewal amount creates panic

The fake bill uses a total such as $399.99 or $499.99, far above what many recipients expect. A short cancellation deadline creates the feeling that checking carefully will cost money.

No real payment may have occurred. The invoice itself is a social-engineering tool, not evidence from a bank or card network.

Step 3: The victim calls the number on the invoice

A fake support agent answers with a generic service greeting or mentions Avast directly. Background noise, ticket numbers, and scripted hold periods can imitate a legitimate call center.

The agent asks for the invoice number and confirms details already printed in the email. Repeating the scammer’s own information does not authenticate the business.

Step 4: Cancellation requires a special refund process

The caller says an ordinary refund cannot be issued by telephone. The victim must visit a website, download a support utility, or complete a secure cancellation form.

The supplied site and software are controlled or selected by the criminal. A remote-access application may be legitimate technology used for a fraudulent purpose.

Step 5: Remote access exposes the victim’s screen

After a connection is approved, the agent can view the desktop, move the pointer, type commands, copy files, and observe information shown during online banking.

The caller may ask the victim to sign into a bank account to receive the refund. Real merchants do not need a customer’s online-banking session to return a card payment.

Step 6: A fake refund balance is displayed

The scammer may alter what appears in the browser, edit page text, move money between the victim’s own accounts, or show a fabricated confirmation screen. It then appears that too much money was refunded.

The victim is blamed for entering an extra zero or selecting the wrong amount. The supposed error creates guilt and a new emergency.

Step 7: The victim is told to repay the difference

Because the bank display appears to show an overpayment, the caller demands repayment through gift cards, cash in a parcel, cryptocurrency, or a wire. These methods are difficult to reverse.

The refund was never real. Any money sent back is the first genuine transfer in the entire story.

Step 8: Access and stolen information are reused

The criminal may leave remote software installed, capture passwords, add browser extensions, or create another user account. Follow-up callers can pose as the bank, police, or a recovery service.

If the victim refuses to pay, the agent may threaten to lock the computer or drain the account. Disconnecting the device and contacting the bank independently ends their control of the conversation.

Why the Invoice Is Not Proof of a Charge

An invoice is a document created by whoever sent the email. It can contain a logo, product name, customer number, and payment language without being connected to any real transaction.

Open the bank or card account through its official app and search pending and posted activity. A charge must appear in that independent record before it can be disputed.

Then open the Avast account portal by typing the official address yourself. Review subscriptions and order history without using any link in the message.

If neither record shows the purchase, do not call the number to ask why. Calling is the action the fraudster designed the document to produce.

Also compare the date, payment method, and product term with prior genuine receipts. A random invoice number and masked card ending are easy to invent, especially when the final digits were exposed in an unrelated breach.

If a genuine Avast renewal exists, cancel or question it through the authenticated Avast account and verified company support. The fake invoice remains irrelevant.

How the Fake Refund Screen Is Created

Remote access lets a scammer manipulate the display without changing the bank’s real ledger. A browser page can be edited locally so the visible balance shows almost any figure.

Another trick moves money from savings to checking. The checking balance increases, but the victim’s total funds do not. The caller hides the transfer description and calls the increase a refund.

The scammer may blank the screen while working, claiming this protects confidential banking systems. In reality, it prevents the victim from watching account changes.

Always verify balances after ending remote access and reconnecting from a clean device. Compare every account, not just the single balance the caller highlighted.

A merchant refund does not require secrecy, gift cards, cash, or returning an accidental excess outside the original payment method.

Warning Signs of an Avast Renewal Scam

• You receive an expensive invoice for a product you did not order.
• The sender address is not an official Avast domain.
• A short deadline pressures you to call immediately.
• The telephone number is the only cancellation route offered.
• The agent needs remote access to process a refund.
• You must sign into online banking while screen sharing.
• The caller says too much money was refunded.
• Repayment must use gift cards, crypto, cash, or a wire.
• The agent asks you to hide the situation from bank staff.
• No matching charge appears on the real statement.

A logo and invoice number are easy to copy. The unusual cancellation process and payment demand are much stronger indicators.

How to Check an Avast Renewal Safely

Do not call, reply, click, or open an unexpected attachment. First inspect the complete sender address and preserve the message for reporting.

Check the payment method directly through its official app. Look at pending charges as well as completed transactions, because a real renewal may not have posted yet.

Visit the Avast account portal by entering the address yourself or using a saved bookmark. Review subscriptions, renewal settings, and order history.

Contact Avast using information obtained from the official site, not the invoice. Avast has asked recipients to report suspicious messages to its designated abuse channel.

If no charge or subscription exists, delete the message after reporting it. There is no benefit in asking the fake call center to remove your address.

Company, Address, and Fulfillment Checks

The display name is not the real sender

An email can show Avast Billing while originating from a free mailbox or unrelated domain. Expand the sender details and inspect the complete address.

The invoice address may be copied or invented

A legitimate-looking office address does not connect the document to Avast. Compare order details only inside the authenticated account and official support system.

The callback number controls the false story

Search results and reverse lookups can provide clues, but they are not the safest contact route. Obtain support information directly from Avast’s official website.

There is no product fulfillment to trace

In many versions, no software license, activation record, card charge, or shipment exists. The expensive line item is simply bait for fake support and refund fraud.

What to Do if You Have Fallen Victim to This Scam

1. End the call and disconnect remote access. Unplug the network cable or turn off Wi-Fi. Do not warn the caller before severing control.
2. Contact the bank from another trusted device. Explain what was displayed, what transfers occurred, and whether the scammer watched your login. Ask the bank to secure access and attempt recalls.
3. Block exposed cards and payment methods. Replace cards whose details were shared and review pending activity. Dispute only genuine charges shown by the provider.
4. Remove remote-control software. Uninstall every tool added during the call, check startup programs and user accounts, then run a full scan with Malwarebytes.
5. Change passwords after the device is clean. Start with email and banking, then update Avast and other sensitive accounts. Use unique passwords and stronger authentication.
6. Inspect the entire bank history. Look for transfers between your own accounts, new payees, external transfers, and small tests. The visible refund may have been a display trick.
7. Limit repeat exposure. AdGuard can help block known scam pages, malicious ads, and redirect chains, but it cannot remove an active remote session by itself.
8. Preserve evidence. Save the email, attachment, callback number, remote software name, transfer instructions, gift card receipts, wallet addresses, and call times.
9. Report the operation. Notify Avast through its official channel, file a report with the appropriate national fraud authority, and give payment details to local police when money was lost.
10. Ignore recovery callers. No stranger can guarantee retrieval of a transfer, crypto payment, cash parcel, or gift card balance for an upfront fee.

Frequently Asked Questions

Is the $499.99 Avast renewal email real?

Avast has warned about fake emails using that amount. Check the authenticated Avast account and real card statement rather than the telephone number in the invoice.

Was my card charged because I received an invoice?

No. An emailed invoice does not prove a transaction occurred. Confirm pending and completed charges directly with the bank or card issuer.

Can Avast support ask for remote access?

Do not grant remote access to an unexpected caller. Verify any support session by starting it yourself through Avast’s official account and contact route.

Why does the fake agent want me to open online banking?

The caller may want to observe credentials, manipulate the visible balance, or direct a real transfer. A merchant does not need your banking login to issue a refund.

What if I installed remote software but sent no money?

Disconnect, remove the software, scan the device, change passwords from a clean system, and tell the bank. Information may have been captured without a visible transfer.

Should I call the invoice number to remove my email?

No. Calling confirms that you respond to the bait and exposes you to the fake support script. Report the email through an official channel and delete it.

The Bottom Line

The Avast Subscription Scam uses a frightening $499.99 renewal to make the recipient call a fake cancellation desk. The invoice may be entirely fabricated, while the money lost during the refund process is real.

Check the bank statement and Avast account independently. Never give an unsolicited support agent remote access, online-banking visibility, or repayment through gift cards, cash, crypto, or a wire.