A fake Avast renewal page made a nonexistent €129.99 bill look like an account record. Yet the most revealing part was hidden in its code: the cancellation form was unfinished and sent nothing. Malwarebytes documented the Belgian-targeted page on September 16, showing how convincing a scam can look before its data-collection mechanism even works.
A cancellation that asks for a future conversation
The French-language page borrowed Avast branding, displayed a five-device subscription and asked for a name, email address and Belgian mobile number. It did not request a password or card details. The researchers found no real subscription or charge behind the claim.
The useful distinction is between a payment record and a claim about a payment. A table inside a webpage cannot establish that money left your account. Here, the supposedly reassuring account layout gave a reason to complete an unrelated contact form.
That changes the decision a visitor faces. “I am not giving them my password” is too narrow a test: a phone number can move an interaction from a page you can inspect to a caller who pressures you in real time. Fake antivirus renewal invoices use the same anxiety about an unwanted bill, although the brand and route to contact differ.
The missing connection matters
Two French handover notes said a submission mechanism still needed connecting. Researchers also found unused styling and generic, fluent copy. They considered these clues consistent with AI assistance, not proof of it. The examined form transmitted nothing; the report does not establish victims or stolen contact records from this sample.
The unfinished state limits what this discovery establishes. A form asking for personal details, a working collection endpoint and a subsequent fraud call are separate pieces of evidence. Finding the first does not establish the other two. Likewise, possible AI involvement describes how the page may have been built; it does not determine whether a particular visitor lost data.
Verify the bill outside the page
The decisive checks happen somewhere the message sender does not control. Open your bank or card account independently to check the claimed transaction, then open the subscription provider’s known app or account website. A real renewal can be handled through the established account; an unexpected page is not the authority on either your balance or your subscription.
Avast’s official guidance confirms that criminals impersonate renewal notices and explains how to report a suspicious email. Keep the original message if you want to report it. Receiving one is different from authorizing a payment, entering information or granting remote access; your response should match what actually happened.
If a later caller claims to be processing that cancellation, end the call and contact the provider independently. If money was transferred, contact your bank through its established channel. A suspicious URL can also be checked with Gridinsoft’s Website Reputation Checker, but a reputation result is not a subscription record or proof that a charge is legitimate.
The case’s lesson is a specific one: evaluate the claimed transaction and the route used to verify it. A polished cancellation screen cannot supply that verification.
References
- Stefan Dasic. “AI helps scammers build convincing antivirus renewal pages.” Malwarebytes Labs, September 16, 2026. Investigation of the fake renewal page.
- Avast Support. “Reporting a spam or scam email to Avast.” Accessed September 16, 2026. Official reporting instructions.
