Impersonation Scams
McAfee Scam Emails: How to Spot Them
McAfee impersonation comes in two flavours: a renewal invoice and an 'your protection has expired' warning. Both want the same thing.
Quick answer
Check your card statement and your actual subscription rather than the email. If there is no charge, delete it. If you use McAfee, sign in at mcafee.com by typing the address yourself to see your real subscription status. Never call a number from the email and never install software it recommends — the 'expired protection' variant is often a route to installing something harmful rather than a refund scam.
Warning signs to look for
- 'Your McAfee subscription has expired — your PC is at risk' with a download button
- An auto-renewal invoice for a product you do not use
- A countdown or a claim that threats were detected on your device
- Sender domains that are not mcafee.com
- A download link for a 'renewal installer' rather than a link to your account
- A support number provided for billing questions
Two versions, two risks
The invoice version mirrors the Norton and Geek Squad refund scam: a bill you do not recognise, a phone number, remote access, and a staged overpayment. The expiry version is different and in some ways worse, because it pushes a download. The 'renewal installer' can be adware, a browser hijacker, or a remote-access tool. Recognising which version you have received tells you what to worry about: a phone number means a call scam, a download button means a malware risk.
Why the expiry claim feels believable
Many computers ship with a trial of security software, so a genuine expiry notice is a real thing people see. Scammers copy that experience, add urgency about being unprotected, and provide a button. Note that no web page or email can scan your device for viruses; any message claiming to have detected threats on your machine is guessing or lying. Real security software reports through its own installed interface, not through your inbox or a browser tab.
How to check what you actually have
Open the security software installed on your computer and look at its status there — that is the authoritative source. On Windows, you can also open Windows Security to confirm what protection is active; Windows includes built-in antivirus, so an expired third-party trial does not leave you unprotected. For billing, sign in at mcafee.com by typing the address, and compare with your card statement. Never use links or numbers from the message.
What McAfee advises
McAfee publishes guidance on impersonation and phishing and asks customers to report suspicious emails rather than respond to them, and to obtain software only from its official site or an authorised retailer. This matches the FTC's general advice: never install software because an unexpected message told you to, and never let an unsolicited caller connect to your computer.
If you already downloaded or called
Disconnect the device from the internet. Uninstall anything you installed from the email, then run a full scan with the security software you already trust, followed by a second-opinion scan. Change your email and banking passwords from a different device. If you gave card details or granted remote access, call your bank on a trusted number. Report to the FTC at reportfraud.ftc.gov.
Have it checked before you act
If you are unsure whether a renewal or expiry notice is genuine, forward it to check@spamcheck.com. SpamCheck will look at the sender and where the buttons actually lead and explain in plain English whether it is safe to ignore.
SpamCheck is not affiliated with or endorsed by the companies mentioned in this guide. Brand names are used only to help consumers identify potential impersonation scams.
Frequently asked questions
- Am I unprotected if my antivirus subscription really has expired?
- Not on Windows. Windows Security provides built-in antivirus that activates when no other product is running. You have time to make a calm decision.
- Can an email detect a virus on my computer?
- No. Nothing in your inbox or a web page can scan your device. Any message claiming to have found threats is fabricating them.
- I clicked the download but did not run the file. Am I at risk?
- Downloading without running is usually harmless. Delete the file from your Downloads folder and run a full scan to be sure.
- Is SpamCheck affiliated with McAfee?
- No. SpamCheck is independent and is not affiliated with, sponsored by, or endorsed by McAfee. The brand is referenced only to help identify impersonation.
Sources
SpamCheck provides informational risk assessments and cannot guarantee that any message is completely safe. When money or sensitive information is involved, independently contact the organization using a trusted phone number or website.
About SpamCheck
SpamCheck helps people understand suspicious emails by letting them forward the message to check@spamcheck.com and receive a plain-English analysis. This guide was published by SpamCheck and written and reviewed by the SpamCheck Editorial Team.
Related guides
Norton Scam Emails: How to Spot Them
A Norton antivirus renewal charge you never approved is almost always a refund scam. Here is how to check it in a minute.
Geek Squad Scam Emails: How to Spot Them
A Geek Squad invoice for a subscription you never had is one of the most common scam emails in circulation. Here is what it is really after.
Microsoft Account Scam Emails: How to Spot Them
Fake Microsoft security alerts and 'your PC is infected' pop-ups both lead to the same place. Here is how to check what is real.
The 10 Best Tools to Protect Against Email Scams in 2026
Filters stop most scams, but not all of them. These ten tools cover the gap between 'your spam filter caught it' and 'you almost clicked.'
Fake Invoice Emails: How to Spot Them
Invoice scams work because paying bills is normal. Here is how to check any unexpected invoice before money moves.
Amazon Scam Emails: How to Spot Them
Fake order confirmations and Prime renewal notices are designed to make you call. Here is how to check any Amazon message in under a minute.