Bewary Get Bewary
Scam patternPublished Jun 27, 2026

Is this McAfee renewal email with a phone number legit?

Bewary fraud research, published by Andrey Khayrullaev, founder. How we research scam patterns.

Example email

Subject: Your McAfee Total Protection Has Been Renewed, Invoice #MCA-2026-84391 Dear Customer, Thank you for continuing with McAfee Total Protection. Your annual subscription has been successfully auto-renewed. Order Summary: Product: McAfee Total Protection (1 Year / 5 Devices) Amount Charged: $499.99 Transaction ID: TXN-7829401856 Date: June 27, 2026 This amount will appear on your statement within 24-48 hours. If you did not authorize this transaction or wish to request a refund, please contact our Billing Support Team: 📞 +1 (888) 507-2194 (Available Mon-Sat, 8 AM - 8 PM EST) Please keep your Transaction ID ready when you call. Thank you, McAfee Billing Department

SCAM

Fake. The giveaway is structural rather than cosmetic: the message gives you a phone number instead of a way to manage the subscription in your own account. The FTC names McAfee as one of the brands this campaign wears, alongside Geek Squad and Norton, and the script is identical in each costume.

How to spot the McAfee scam

  • There is a phone number and no way to cancel online. That inversion is the whole design: a real subscription is managed in your account, and this one can only be argued with by voice.
  • A deadline of about 24 hours to dispute the charge. The FTC quotes that same window in its own alert, because panic is what gets people dialling.
  • The charge is for hundreds, far more than the product costs. The figure is chosen to be alarming enough to override the instinct to check your bank first.
  • The email has no link to an account, or the link goes nowhere useful. There is nothing to click because the number is the payload.
  • Whoever answers wants remote access to your computer. The FTC is explicit about where that goes: spyware installed, online banking credentials stolen, the account drained.
  • You are asked for bank details so the refund can be processed. The refund is the trap, not the resolution.
  • Then comes the reversal: they claim they refunded too much and ask you to send the difference back, by gift card, wire transfer, bank transfer, cryptocurrency or a payment app. Those are the routes that cannot be reversed, which is exactly why they are named.

What to do now

  1. Do not ring the number. Manage or cancel any real subscription by signing in to your account the way you normally would.
  2. Check your bank or card statement for the charge. If it is not there, there is nothing to dispute.
  3. Never install remote-access software at a caller's request. That single step is what turns a nuisance email into a drained account.
  4. If you gave remote access, disconnect the machine from the internet, run a full security scan, and change your banking passwords from a different device.
  5. If you were talked into repaying an 'overpayment', tell your bank immediately and say you were induced to send it. Speed matters more than anything else at that point.
  6. Report it at ReportFraud.ftc.gov and delete the message.

What it looks like on your phone

Recreated example of the McAfee scam email: Subject: Your McAfee Total Protection Has Been Renewed, Invoice #MCA-2026-84391

Dear Customer,

Thank you for
A representative example based on common reports. Exact wording varies.

Got a message like this? Check yours free

Paste any text, link, or number you are unsure about. Bewary gives you a straight answer in seconds, and the exact reason why.

Private. Never sold, never tied to you.

Sources and reporting

Use official channels to confirm a suspicious request and report fraud.