Scam library · Tech support · Email & phishing
McAfee 'subscription expired' pop-up and renewal scam
Two versions use the McAfee name. One is a browser pop-up: 'Your McAfee subscription has expired. Your PC is infected with 5 viruses. Renew now.' The other is a fake renewal invoice by email.
The pop-up usually comes from a website that asked you to 'allow notifications'. It isn't coming from McAfee or from your computer.
What the message looks like
From: Notification from secure-pc-alerts[.]site
Subject: McAfee Total Protection
Your McAfee subscription has EXPIRED!
Your PC is unprotected and may be infected with (5) viruses. Renew now to restore protection.
[ Renew Now ] [ Scan ]
How this scam works
When you allow notifications on a shady website, it can keep sending you alerts that look like system warnings, even after you close the page. Clicking 'renew' sends you through affiliate links to a real or fake checkout. Some pages ask for your card on a copycat site.
No website can scan your computer for viruses just by being open. A message saying '5 viruses found' from inside a browser tab is invented.
The email version works like other fake renewal invoices: it wants you to call a number, where scammers ask for remote access and your bank login.
Red flags
- A virus count from a browser notification or web page.
- The name of a website appears under the alert (for example 'from secure-pc-alerts...').
- Urgency: 'expired', 'unprotected', 'act now'.
- You don't have McAfee installed, or it shows a different status when you open it.
- An emailed invoice asks you to call to cancel.
How to tell it’s fake
- Open the McAfee app on your computer directly, or sign in at mcafee.com, and check your subscription there.
- Look at where notifications come from: in Chrome or Edge, real system alerts don't name a website.
- Remove notification permission for any site you don't trust in your browser's site settings.
What to do if you clicked, paid or shared info
Don’t panic, and don’t blame yourself. These scams are built by professionals. Act quickly, one step at a time.
If you clicked a link or called back
- If you only clicked, close the tab. In Chrome or Edge settings, go to Site settings > Notifications and remove sites you don't recognize.
- If you downloaded a 'cleaner' or 'scanner', uninstall it.
If you paid
- If you paid on a copycat page, call your card issuer and dispute the charge. If you paid on McAfee's real site through the pop-up, you can ask McAfee for a refund.
If you shared personal info, a password or a code
- If you called a number and gave remote access or banking details, call your bank and change passwords from another device.
Where to report and get help (U.S.)
If a message seems legit and you’re still not sure, get a second opinion before you act. Reporting helps stop scammers, even if money can’t be recovered. If you are in danger, call 911.
- Your bank or card issuer
Call the number on the back of your card or on your statement, not one from the message. Ask them to stop or reverse the payment and to watch the account. - Federal Trade Commission (FTC) · ReportFraud.ftc.gov
Report the scam and get a step-by-step recovery plan. - FBI Internet Crime Complaint Center (IC3) · ic3.gov
Report scams that happened online, especially if money was lost. Include phone numbers, websites and payment details. - AARP Fraud Watch Network Helpline · aarp.org helpline
Free, for anyone of any age: trained volunteers help you sort out next steps. 877-908-3360, Monday to Friday, 8 a.m. to 8 p.m. Eastern. - IdentityTheft.gov · IdentityTheft.gov
If you shared your Social Security number or someone opened accounts in your name.
How Gmork Scam Guard would warn you
Scam Guard runs in Chrome and Edge on your computer. When a page suddenly fills the screen, plays alarms or claims your computer is infected, it recognizes the pattern of a fake support warning and tells you, in plain words, that it's safe to close the tab. In a renewal email you have open in Gmail or Outlook on the web, it points out the lookalike sender and the call-this-number trick. If a message seems legit and you're still unsure, get a scam expert's second opinion before you call anyone.
Scam Guard can miss things, so the checks above still matter. See what it warns about and what it keeps private.
Questions people ask
- Is the McAfee 'your subscription has expired' pop-up real?
- If it appears in your browser and names a website, it's not from McAfee. Check the McAfee app or your account directly.
- How do I stop these pop-ups?
- Remove notification permissions for the website in your browser settings. They usually stop right away.
- Did the website really find viruses?
- No. A web page can't scan your computer. The virus count is made up to scare you.