A fake Avast renewal page told Belgian users they had been charged €129.99, then asked for contact details to cancel the nonexistent subscription. Anyone receiving an unexpected antivirus renewal notice should verify it through their bank and the provider’s official app or website, not through links in the message.
A caller may then ask the victim to install remote-access software, which lets another person control the computer, or offer to reverse a payment that never happened. This can put accounts, passwords and money at risk.
Unused styling, vague but grammatically correct marketing copy and those handover-style notes were consistent with AI-assisted development, according to Malwarebytes Labs. However, generated code has no watermark, so AI involvement could not be proven from the files alone.
The observed form was inactive, meaning this particular page did not send entered details anywhere at the time examined. It may have been an abandoned build or a template awaiting completion.
The phone call may be the real goal
Malwarebytes Labs found that the cancellation form requested a full name, email address and Belgian mobile number, but no password or payment details. That limited request may appear harmless while giving scammers enough information to pose as support staff in a follow-up call.A caller may then ask the victim to install remote-access software, which lets another person control the computer, or offer to reverse a payment that never happened. This can put accounts, passwords and money at risk.
AI clues found in an unfinished page
The site looked more polished than many scam pages, but its code contained two French notes addressed to the person who commissioned it. The notes explained that the form did not yet submit data and still needed a real submission process.Unused styling, vague but grammatically correct marketing copy and those handover-style notes were consistent with AI-assisted development, according to Malwarebytes Labs. However, generated code has no watermark, so AI involvement could not be proven from the files alone.
The observed form was inactive, meaning this particular page did not send entered details anywhere at the time examined. It may have been an abandoned build or a template awaiting completion.
What to do with a renewal notice
Professional design, correct grammar and familiar logos are no longer useful proof that a page is genuine. Focus instead on whether a real charge exists and how you reached the page.- Check your bank or card statement directly. If the claimed payment is absent, there is nothing to cancel.
- Open the antivirus company’s official app or type its website address yourself, then check your subscription status after signing in.
- Do not install remote-access software for an unexpected caller claiming to handle a refund or cancellation.
- If you already installed such software, disconnect the PC from the internet, remove it and change passwords using another device. Contact your bank immediately if you shared card details or sent money.
