The scam page was flawless. The AI left its notes in the code.

The advice used to be simple. Watch for the clumsy wording, the wrong currency symbol, the logo stretched out of shape. A page Malwarebytes pulled apart this week shows why that advice has stopped working.

The site targeted Belgium, was written in French, and told visitors their Avast Premium Security subscription had just renewed at 129.99 euros for five devices, with the next charge due in February. Green tick, status badge, clean layout, grammar you could not fault. Stefan Dasic at Malwarebytes read the source and found the tell: two notes left behind in the code, in French, addressed to whoever had commissioned the work, explaining that the form did not yet send the data anywhere and would need to be wired up. Handover notes, in other words, of the kind an AI assistant writes for the person who asked it to build something. Next to them sat styling for sections that had already been deleted, and four paragraphs of subscription copy that never once named an actual Avast feature - not the firewall, not the VPN, not the ransomware protection.

Look at what the cancellation form asks for and the plan becomes obvious. Full name, email address, Belgian mobile number. No password box. No card details. The phone number is the product. Someone rings a day or two later as Avast support, sympathetic about the charge, and walks you through installing a remote-access program so they can arrange the refund. That is the point at which money moves.

Judge the address bar, not the artwork. A renewal notice for software you actually own can be checked inside the software itself, or on the account page you reach by typing the address in yourself rather than following a link. If a call like that has already happened in your house, Tendvane's safety check will show you what got installed while the phone was to your ear.