Antivirus 'Expired' Pop-up Scareware
A pop-up claims your antivirus expired and your device is at risk, pushing you to 'renew' or download something that is fake or harmful.
Think a message like this reached you? You can check it right now.
What this scam is
While browsing, a full-screen pop-up warns that your antivirus has expired and your computer is exposed, urging you to renew immediately or download a 'fix.' The button leads to a phony renewal that captures your card, or installs unwanted or malicious software. Real antivirus renewals happen inside the program you installed, not through a browser pop-up.
What it usually looks like
- A browser pop-up saying your antivirus expired.
- Alarming red warnings and a countdown.
- A 'renew now' or 'download update' button.
- A brand name you may not even use.
Common warning signs
- Antivirus warnings that appear in a web browser.
- Countdowns and scare language.
- A renewal that asks for card details on a web page.
- Prompts to download an 'update' from a pop-up.
Example wording scammers use
“WARNING: Your Norton subscription has expired. Your PC is unprotected. Renew now to remove 5 threats.”
“Windows Defender detected malware. Update your protection immediately.”
These are illustrative examples written by ScamSplain, not real messages.
What the scammers want
- Your card details on a fake renewal page.
- To install unwanted or malicious software.
- To push you into a tech-support call.
What to do
- Close the browser tab or window; do not click inside the pop-up.
- Check your real antivirus by opening the actual program.
- Renew only inside the software you installed.
- Run a scan if you are unsure.
What to do if you already responded
- Call your card issuer if you entered card details.
- Uninstall anything you downloaded and run a security scan.
- Report at reportfraud.ftc.gov.