Since at least 2021, an email scam has targeted victims claiming that Norton has renewed their annual subscriptions. Some of the fraudulent renewal emails mentioned Norton Total Protection, Norton Total All Round Security, Norton 360, Norton 360 Auto Edition, Norton PC Life, Norton Family All Device and Norton LifeLock. Turns out some of them weren’t even real Norton products. We have reviewed these emails, which are in fact part of a known “phishing” operation aimed at tricking recipients into divulging private information.
How Norton Email Scam Works
The phone number listed in some of Norton’s fraudulent emails was 760-248-4214. We called the number knowing it was all a ruse. We were connected to a scammer who may have been in a foreign call center. The scammer asked for the invoice number in the email.
This is called a refund scam. The emails claimed that a payment had been successfully processed to renew a Norton subscription. However, it was nothing more than a fake set up for the scam.
The goal for the scammers was to get consumers to respond via email or phone asking for a refund for the supposed Norton product renewal. Scammers would eventually ask for bank account or credit card details, claiming that a refund would be processed. In reality, they would take the financial information and attempt to steal funds.
Norton Email Scam Example #1
One Norton scam email we reviewed originated from [email protected] and copied [email protected] He claimed an “annual product membership” for Norton Total Protection had been renewed. The email also mentioned the same phone number which started with the 760 area code. The email addresses and phone number were all run by scammers:
SUBSCRIPTION INVOICE ID #VPH24012022DSB
Welcome senior member,
Thank you for your interest in our products.
Your annual NORTON TOTAL PROTECTION product membership has been successfully renewed and updated.
PRODUCT TITLE End Date Qty Total Amount Payment Method
NORTON TOTAL PROTECTION In 1 year 1 $524.00 USD Auto Debit
Invoice No. VPH24012022DSB
Order date: Jan 24, 2022
If you need urgent assistance, please call our experts for refund and settlement issue at +1-(760)-(248)-4214
—
Truly,
Aaron M.
Refund and Settlement Service
Norton Email Scam Example #2
Another Norton scam email came from [email protected] It mentioned Norton Total All Round Security. A small red flag in the fake product name was the fact that the scammers chose the words “All Round” instead of “All Around”. Again, [email protected] was copied to the email, and the same phone number was there too. To reaffirm, these email addresses and phone number were all part of the scam and were not managed by Norton:
Successful payment, Invoice DYU24012022LAM
Hello Customer!
Thank you for your interest in our products.
Your annual NORTON Total All Round Security membership has been successfully renewed and updated.
ITEM End Date Qty Total Amount Payment Method
NORTON Total All Round Security in one year 1 $267.00 USD Auto Debit
Invoice No. DYU24012022LAM
Invoice date: 2022-01-24
If you need urgent help,
please call our experts for refund and settlement issue at +1-(760)-(248)-4214
—
Thank you!,
Patrick R
BILLING AND SETTLEMENT DEPARTMENT
Norton email scam example #3
On January 24, a Reddit user posted a third example of the Norton email renewal scam. This seemed to be a variation of the same, probably leading to a fake refund:
Your order has been received
From: Buying Team
Hey,
Thank you for being with us!
We are pleased to inform you that your order has been successfully placed, it will be activated shortly.
If you want to know more about your order, see the invoice attached to this letter.
Cordially,
The billing team!
PDF-XXX224.pdf
Norton Email Scam Example #4
A fourth email we reviewed came from the email address [email protected] The message copied to [email protected] He read:
order confirmation email # MDI948__ID
VALUABLE_______consumer
thank you for joining norton 360 auto-editing services. through us.
we received an order PLACED by you on your norton account which is linked to your bank account.
invoicing DESCRIPTION
Customer ORDER ID: – # MDI948__ID
service details: – pc ANTIVIRUS (system)
paid BY: – direct debit
PRICE cost: – $367.29
PURCHASE on: – January 21, 2022
your subscription has been ACTIVATED. that’s why we sent you this email or if you want to continue this subscription THEN please forget this email or if you have any problems feel free to connect WITH our helpdesk.
you can reach us at: – 1+ 804-(742)-0254
Best regards
JOHN WILLIAMSON
The scammer’s phone number was emailed to 804-742-0254. We called the number but did not receive an answer. The goal here was once again to trick unsuspecting victims into contacting the scammers in an attempt to get a refund. This would again lead to money being stolen from the consumer’s financial accounts.
Norton Email Scam Example #5
A fifth example of the fraudulent email came from the email address [email protected] (allegedly someone named Gerard Riou). We also noticed that [email protected] was copied into the message. He read:
(KXWAGTRZY – COMMAND)
Dear Valued Customer,
Your one-year plan for NORTON – SUPPORT has been successfully renewed and restored.
The complete transaction will be reflected within the next 24-48 hours on your account statement.
_PRODUCT DESCRIPTION_
……………………………………………………………………………………………
Invoice Number: KXWAGTRZY
Product Code: NORTON – SUPPORT
………………………………………………………………………………………………
Start date: January 25, 2022
End date: 1 year from date of purchase
………………………………………………………………………………………………
Amount: $242.43
Payment method: AUTO-RENEWAL
………………………………………………………………………………………………
* If you wish to request a REFUND, do not hesitate to contact our billing department as soon as possible. *
You can reach us at +1 – (844) – 678 – 9560
Greetings,
Billing service
The phone number given by the scammers was 844-678-9560.
Norton Email Scam Example #6
This email circulated in November 2021 from an account named Bible Prophecy with the email address [email protected]:
Payment received for assistance Call +1 (919) 617-6616
Hello,
We have received your payment, please find the invoice attached.
For any questions or queries, please contact us on 24/7 customer support at +1 (919) 617-6616.
Greetings!
Nortan Security
Nortan Invoice.pdf
The scammer’s phone number was 919-617-6616.
Norton Email Scam Example #7
Another message that circulated in January 2022 allegedly came from an account named Norton.Alert with the email address [email protected] The end of the email mentioned someone named Erick McBride. This may not have been a renewal or refund scam, but it was definitely a scam:
URGENT: Your Norton subscription has expired… Your device has been infected (23) m8aUF5OyNI
-This message was sent by a trusted sender.
Protect your data and your privacy. Click here.
Get an annual subscription to Norton 360 Deluxe for $29.99 for the first year.
“WARNING!!! The system has been infected (13) on your computer…”
Norton Affiliate Program
Your devices may be at risk!
Buy or renew now to protect your PC!
If your PC is not protected, it is exposed to viruses and other malware.
Be protected.
*Advertising by an independent Norton affiliate
This is third-party advertising from a Norton marketing partner.
This offer is brought to you by Erick McBride.
Norton Email Scam Example #8
Also in January 2022, an email from an account named Threat Protection listed the email address [email protected] and said it came from “via nats.quarkfive.net”. Much like the previous example, this one may not have been a refund or renewal scam, but it was definitely a scam:
Don’t leave your devices at risk – Get virus protection now
Salvation
Is your computer safe? Save big on
Norton Antivirus
Activate today to protect your devices
It was received in the Comic Sans font:
Norton Email Scam Example #9
In this ninth example, the fraudulent email came from [email protected], copied to [email protected], and mentioned the phone number 937-340-1969:
SUBSCRIPTION STATEMENT – ONK2022FY
Dear user,
Thank you for your interest in our products.
Your annual NORTON 360 membership has been successfully renewed and updated.
Product Title End Date Quantity Total Payment Method
NORTON 360 In 1 year US$1,548.00 Automatic DebitInvoice No. ONK2022FY
Order date: 2022-01-26
If you need urgent assistance, please call our experts for reimbursement and settlement on +1 – (937) – (340) – 1969
—
Greetings,
Aaron M.
BILLING AND SETTLEMENT DEPARTMENT
What to do if you receive one of these emails
The best course of action is to remove fraudulent emails making claims about Norton, renewals and refunds.
For more details, we recommend visiting the company’s official website, Norton.com. The company has posted a page about these renewal refund scams.
They also listed several email addresses that Norton used to send official correspondence: [email protected], [email protected], [email protected], [email protected] and [email protected] .nortonstore.hk. . These can be trustworthy, depending on the company.
Curious to know how the writers of Snopes verify information and craft their stories for public consumption? We’ve put together a few posts that help explain how we do what we do. Happy reading and let us know what else you would like to know.
