{
  "slug": "mcafee-renewal-invoice",
  "canonical_name": "McAfee renewal invoice scam",
  "family": "fake-invoice-callback",
  "impersonates": {
    "brand": "McAfee",
    "disclaimer": "McAfee is not involved; criminals impersonate the brand.",
    "official_fraud_page": null
  },
  "goal": [
    "callback",
    "remote-access",
    "payment"
  ],
  "channels": [
    "email"
  ],
  "summary": "A fake \"order confirmation\" or \"auto-renewal\" for McAfee Total Protection with an amount and a number to call to cancel. The brand rotates; the call centre behind the number is the same trade.",
  "status": "active",
  "first_seen": null,
  "last_seen": null,
  "recognise": [
    "An \"order\" you did not place, priced high enough to alarm",
    "Cancel-by-phone only",
    "No account details, no last four digits"
  ],
  "variants": [],
  "specimen": null,
  "tells": [],
  "indicators": {
    "sender_domains": [],
    "senders": [],
    "reply_to": [],
    "phone_numbers": [],
    "urls": [],
    "wallets": [],
    "attachments": [],
    "note": "Indicators change weekly; an empty list never means an email is safe."
  },
  "what_to_do": {
    "if_received": [
      "Do not call, do not reply, delete it",
      "Check any real subscription by typing mcafee.com yourself"
    ],
    "if_called_or_paid": [
      "Gave remote access? Disconnect from the internet, uninstall the tool they had you install, change passwords from another device",
      "Paid by card or bank transfer? Call your bank now and dispute it. Gift cards? Call the card issuer with the card numbers",
      "Expect a call-back from a \"refund department\" — that is act two of the same scam. Hang up"
    ],
    "report_links": [
      {
        "label": "Report to the FTC",
        "url": "https://reportfraud.ftc.gov/"
      },
      {
        "label": "Report to FBI IC3",
        "url": "https://www.ic3.gov/"
      }
    ]
  },
  "malware_family": null,
  "timeline": [
    {
      "date": "2026-09-02",
      "type": "registry",
      "title": "Family created",
      "text": "Opened at launch; no dated specimen on record yet — send yours.",
      "added": [],
      "removed": [],
      "sources": []
    }
  ],
  "related": [
    "geek-squad-renewal-invoice",
    "norton-renewal-invoice"
  ],
  "sources": [],
  "legacy_urls": [],
  "legacy_redirect": false,
  "created": "2026-09-02",
  "updated": "2026-09-02",
  "changelog": [
    {
      "date": "2026-09-02",
      "text": "Record created at the registry launch."
    }
  ],
  "url": "https://soft2secure.com/scams/mcafee-renewal-invoice",
  "licence": "CC BY 4.0",
  "generated": "2026-09-03"
}