Real Subscription Renewal vs Fake Subscription Notice
How to tell a genuine subscription renewal confirmation from a fake invoice designed to prompt a phone call that leads to a remote-access scam.
Last reviewed: 1 June 2026
Renewal notices are routine. Subscriptions do renew automatically, invoices do arrive by email, and the amounts are sometimes higher than you remembered because a plan changed or an annual charge replaced a monthly one. Fake renewal notices live inside that ordinary confusion. One arrives for antivirus, cloud storage or a streaming service, quoting a charge far larger than you expect, and its only real purpose is the telephone number sitting in the middle of it. Ringing that number connects you to someone friendly who offers to cancel and refund, then walks you into remote access to your computer or into your banking screens. It works because you rang them, which feels safe. The distinction that matters most is that genuine billing is managed on the provider website, never by phoning a number from an email.
Side-by-side comparison
| Genuine subscription renewal | Fake subscription renewal notice | |
|---|---|---|
| Delivery channel | Sent from the service official email domain; matches the address on your account | Sent from a personal or lookalike email address with no relation to the service |
| Account confirmation | References your actual username, last four digits of payment card, and subscription start date | Generic reference — 'your subscription' with no specific account details |
| Action route | Directs you to the service official website to manage billing; no phone number in the email | Prominently displays a phone number to 'dispute the charge' or 'cancel immediately' |
| Amount | Amount matches your subscription price and is consistent with prior renewal notices | Unusually high amount — sometimes hundreds more than you have ever paid — to provoke a panicked call |
| Refund process | Refunds processed through the original payment method via the website; no remote access needed | Caller offers to process a refund but needs remote access to your computer 'to transfer the funds' |
| Urgency | Renewal already processed; no immediate action required unless you want to cancel | Warns you have 24 hours to dispute before the charge is final |
Common red flags
- Email prompts you to call a phone number to cancel or dispute a charge
- Charge amount is much higher than your actual subscription cost
- Sender address is not the official service domain
- Caller asks for remote access to process a refund
- No specific account details — just 'your subscription'
Verification steps
- Log in to the service account directly to check your actual billing history
- Check your bank or card statement for the charged amount and merchant name
- Do not call any phone number in the email — use the service official support page
- If you do not have a subscription to the named service, the email is fraudulent
What not to do
- Do not call the phone number in an unexpected renewal email
- Do not allow remote access to your computer as part of any refund process
- Do not provide banking details over the phone to process a refund
A safe response
Do not ring the number. Check whether the charge is real by looking in two places you control: your bank or card statement, and your account on the provider own site, reached by typing the address yourself. If the charge is in neither, nothing has happened and the email can be deleted. If you do hold the subscription and want to cancel, do it inside your account. If you have already called and let someone onto your computer, disconnect it from the internet and shut it down, then ring your bank from another device to freeze cards, change your passwords, and report it to your national fraud reporting service.
Frequently asked questions
I do not even have this subscription. Should I reply and tell them to cancel it?
No. Replying mainly confirms that a real person reads that address, which usually brings more attempts rather than fewer. An invoice for a service you never bought is fake by definition, so there is nothing to cancel and no charge to dispute with anyone. Delete it, and if you want certainty, check your bank statement for anything matching the amount. Marking the message as phishing in your email client helps filter similar ones in future.
What if the email contains the last four digits of my card?
Partial card details can be obtained through data breaches or by guessing common card formats. They do not confirm the email is genuine. Always verify through the service official website.
I called the number and gave remote access. What now?
Disconnect from the internet immediately and shut down the computer. Contact your bank to freeze accounts and dispute any charges. Change passwords from a different device. Report to your national fraud and cybercrime authority.