Norton Renewal Email Scam Lures Victims with Fake Invoice

We called the phone numbers listed in the emails. They had nothing to do with Norton or Norton products.

  • Published
A Norton email renewal refund scam targeted consumers in early 2022 and likely long before.
Image via Budrul Chukrut/SOPA Images/LightRocket via Getty Images

Claim

Norton renewed your annual membership and said to contact the company for a refund.

Origin

Since at least 2021, an email scam has targeted victims with the claim that Norton had renewed their annual membership subscriptions. Some of the scam renewal emails mentioned Norton Total Protection, Norton Total All Round Security, Norton 360, Norton 360 Auto Edition, Norton PC Life, Norton Family All Device, and Norton LifeLock. Turns out, a few of these weren’t even real Norton products. We looked into these emails, which are in fact part of a known “phishing” operation aimed at tricking recipients into divulge private information.

How the Norton Email Scam Works

The phone number listed in some of the Norton scam emails was 760-248-4214. We called the number knowing that the whole thing was a ruse. We were connected to a scammer who may have been located in a foreign call center. The scammer asked for the invoice number in the email.

This is known as a refund scam. The emails claimed that a payment had been successfully processed to renew a Norton subscription. However, this was nothing more than a fake set up for the scam.

The goal for the scammers was for consumers to respond by email or phone to ask for a refund for the supposed Norton product renewal. The scammers eventually would ask for bank account or credit card details, claiming that a refund would be processed. In reality, they would take the financial information and attempt to steal funds.

Norton Email Scam Example #1

One Norton scam email we reviewed was from jamgre549@gmail.com and copied nortoncc2021@outlook.com. It claimed that an “annual product membership” for Norton Total Protection had been renewed. The email also listed the same phone number that began with the 760 area code. The email addresses and phone number were all managed by scammers:

SUBSCRIPTION INVOICE ID #VPH24012022DSB
 
Welcome Prime Member,
 
Thank you for your interest in our products.
 
Your Annual product membership for NORTON TOTAL PROTECTION has been renewed & updated successfully.
 
PRODUCT TITLE End Date Qty Total Amount Payment Method
 
NORTON TOTAL PROTECTION In 1 year 1 $524.00 USD Auto Debit
 
Invoice No. VPH24012022DSB
 
Order Date: 24 Jan 2022
 
If you require urgent assistance, please call our Experts for refund and settlement issue on  +1 – ( 760 ) – ( 248 ) – 4214
 
Sincerely,
Aaron M.
Refund & Settlement Dept.
A Norton email renewal refund scam targeted consumers in early 2022 and likely long before.
Flashback to 2010 when it was more popular to buy McAfee and Norton security products in stores. (Photo by Justin Sullivan/Getty Images)

Norton Email Scam Example #2

Another Norton scam email was from sarwoo846@gmail.com. It mentioned Norton Total All Round Security. One little red flag in the fake product name was the fact that the scammers chose the words “All Round” instead of “All Around.” Once again, nortoncc2021@outlook.com was copied onto the email, and the same phone number was there too. To restate, these email addresses and the phone number were all part of the scam and were not managed by Norton:

Payment successfull, Invoice DYU24012022LAM

Hello Customer!

Thank you for your interest in our products.

Your Annual membership for NORTON Total All Round Security has been renewed and updated successfully.

ITEM Finish Date Qty Total Amount Method of Payment

NORTON Total All Round Security In One year 1 $267.00 USD Auto Debit

Invoice No. DYU24012022LAM

Invoice Date: 2022-01-24

If you require urgent assistance,

please call our Experts for refund and settlement issue on +1 – ( 760 ) – ( 248 ) – 4214


Thank you!,
Patrick R.
BILLING & SETTLEMENT DEPARTMENT

Norton Email Scam Example #3

On Jan. 24, a Reddit user posted a third example of the Norton email renewal scam. It appeared to be a variation of the same thing, likely leading to a fake refund:

Your Order Has Been Received

From: Purchase Team

Hey,

Thanks for being with us!

We are glad to inform you that your order has been successfully placed, it will activated shortly.

If you want to know more details about your order then go through the invoice attached with this mail..

With Regards,

Billing Team!

PDF-XXX224.pdf

A Norton email renewal refund scam targeted consumers in early 2022 and likely long before.
Scammers and hackers are often depicted in movies as hooded masterminds looking at code from “The Matrix” fly down the screen while sitting in a room lit in menacing colors. However, the reality of a scammer’s life is usually far less glamorous. (Courtesy: Seksan Mongkhonkhamsao/Getty Images)

Norton Email Scam Example #4

A fourth email we reviewed came from the email address sienna9355jac@gmail.com. The message copied in consumer946@gmail.com. It read:

order confirmation mail # MDI948__ID

VALUABLE_______consumer

thanks for joining norton 360 auto edition services. through us.

we have receive an order PLACED by you in your norton account which is linked with your bank account.

billing DESCRIPTION

client ORDER I.d : – # MDI948__ID

service details: – pc ANTIVIRUS (system)

paid THROUGH: – auto debit

PRICE cost : – $367.29

PURCHASE on : – 21ST jan 2022

your subscription has been ACTIVATED. that’s the reason why we sent you this mail or if you want to continue this subscription THEN kindly forget this mail or if you are facing any kind of problems then please feel free to connect WITH our help care department.

you can reach us ON: – 1+ 804-(742)-0254

BEST regards

JOHN WILLIAMSON

The scammer’s phone number was emailed as 804-742-0254. We called the number but did not receive an answer. The goal here was once again to lure unsuspecting victims to contact the scammers to try to obtain a refund. This would again result in the theft of money from the consumer’s financial accounts.

Norton Email Scam Example #5

A fifth example of the scam email came from the email address gerardriou598@gmail.com (purportedly someone named Gerard Riou). We also noticed that nortoncustomer58@gmail.com was copied into the message. It read:

(KXWAGTRZY – ORDER)

Dear Precious Customer,

Your 1 year plan for NORTON – SUPPORT has been successfully renewed & restored.

The full transaction will be reflected within next 24 to 48 hours on your account record.

­­_PRODUCT DESCRIPTION_

……………………………………………………………………………………………

Invoice No : KXWAGTRZY

Product Code : NORTON – SUPPORT

………………………………………………………………………………………………

Starting Date : 25th January 2022

Ending Date : 1 year from the date of purchase

………………………………………………………………………………………………

Amount : $242.43USD

Payment Method : AUTO RENEW

………………………………………………………………………………………………

* If you wish to claim a REFUND then please feel free to contact our billing department as soon as possible. *

You can Reach us on +1 – (844) – 678 – 9560

Regards,

Billing Department

The phone number listed by the scammers was 844-678-9560.

Norton Email Scam Example #6

This email went around in November 2021 from an account named Bible Prophecy with the email address rohrbaceydewitt@gmail.com:

Payment Received for Help Call +1 (919) 617-6616

Hello,

We have received your Payment, Kindly find the enclosed invoice.

For any questions or queries, Kindly connect us on 24*7 customer support at +1 (919) 617-6616.

Regards!

Nortan Security

Nortan Invoice.pdf

The scammer’s phone number was 919-617-6616.

Norton Email Scam Example #7

Another message that went around in January 2022 was purportedly from an account named Norton.Alert with the email address Qy8hkBiNo9G@q4xdysd.adjy.bourecanapshi.com. The end of the email mentioned someone named Erick McBride. It might not have been a renewal or refund scam, but it was definitely a scam:

URGENT: Your Norton Subscription Expired… Your device has been infected (23) m8aUF5OyNI

-This message was sent from a trusted sender.

Protect your data and privacy. Click Here.

Get a Norton 360 Deluxe annual membership for $29.99 your first year.

“WARNING!!! The system has been infected (13) on your computer…”

Norton Affiliate Program

Your Devices May Be At Risk!

Purchase or renew now to keep your PC protected!

If your PC is unprotected, it is at risk for viruses and other malware.

Get Protected.

*Advertisement by an independent affiliate of Norton

This is a third party advertisement from a marketing partner of Norton.

This offer is brought to you by Erick McBride.

Norton Email Scam Example #8

Also in January 2022, an email from an account named Threat Protection showed the email address aqfmd9jf55@prefeiricpl.com and said it came “via nats.quarkfive.net.” Just like the previous example, this one might not have been a refund or renewal scam, but it was definitely a scam:

Don’t leave your devices at risk – Get Antivirus Protection Now

Hi

Is your computer safe? Save big on

Norton Antivirus

Activate today to protect your devices

It was received in the Comic Sans font:

A Norton email renewal refund scam targeted consumers in early 2022 and likely long before.
Norton would never use Comic Sans font in its messaging.

Norton Email Scam Example #9

In this ninth example, the scam email came from naoetancet6386@gmail.com, copied in nortoncc2022@outlook.com, and mentioned the phone number 937-340-1969:

STATEMENT OF SUBSCRIPTION – ONK2022FY

Dear User,

Thank you for your interest in our products.

Your Annual membership for NORTON 360 has been renewed and updated successfully.

Product Title Finish Date Quantity Total Payment Method
NORTON 360 In 1 year 1 $548.00 USD Automatic Debit

Invoice No. ONK2022FY

Order Date: 2022-01-26

If you require urgent assistance, please call our Experts for refund and settlement issue on +1 – ( 937 ) – ( 340 ) – 1969


Regards,
Aaron M.
BILLING & SETTLEMENT DEPARTMENT

Norton Email Scam Example #10

This example claimed to come from the company Intuit from quickbooks@notification.intuit.com. However, a check of the email’s information showed it likely came from genstjeni667890@outlook.com. The email address tester@doli.com was also copied in. The phone number listed was 888-913-5992:

Invoice 1242 has been paid…

INVOICE NO. 1242 DETAILS

Sales Team Norton

DUE 02/03/2022
USD 367.84
Print or save
Powered by QuickBooks

Dear Customer,

Your Order has been Processed as online delivery.
Transaction Id: PTYRF-78945 For Norton Antivirus.

Amount has been charged Successfully..

Any issues with the Invoice.
Dial Us Now: +1 (888) 913-5992

Bill to Customer
Terms Net 30
31/01/2022
Sales USD 367.84
All-in-one protection that includes device security with antivirus to help block hackers, Secure VPN to help keep your online activity private, Password Manager and more.
1 X USD 367.84
Balance due USD 367.84
Dear Norton User,

We have Processed the payment request Successfully.
Amount will be charged in next 2 hours .

Any issues with the Invoice Please get in touch Now +1 (888) 913-5992

Norton Billing
Print or save
Sales Team Norton
If you receive an email that seems fraudulent, please check with the business owner before paying.

© Intuit, Inc. All rights reserved.Privacy | Security | Terms of Service

Norton Email Scam Example #11

The phone number 806-839-6579 showed up in this one, as did the email addresses william9089tur@gmail.com and consumer7001@gmail.com:

ONE STEP STRONGER #TRF6849JO

Dear respect user

As part of the Norton family Your plan for computer protection has been successfully initiated and UPDATED.

The amount will be reflecting in YOUR account between 24-48 hours or 3-4 working days

The Product information ARE listed below:

……………………………………………………………………………………………………………………………………..

Invoice NUMBER : TRF6849JO

Item name : Norton SECURITY

……………………………………………………………………………………………………………………………..

Order DATE : 31th Jan 2021

Expiry date : 24 months from the date OF initialization

………………………………………………………………………………………………………………………………..

AMOUNT :$350 USD

PAYMENT METHOD : auto renewal

toll FREE :+ 1 (806 – 839 – 6579)

………………………………………………………………………………………………………………………………….

If you do not wish to pursue further and wish to cancel the subscription kindly GET in touch with us

You can reach us ON

Regards

BILLING department

Another message from the same email address had a different subject line: “START A NEW ONE #IYG4762DC.”

Norton Email Scam Example #12

This version of the scam email came from sttrojeprrejui28js@gmail.com:

Invoice No. #INV80019PJC

Sttroje Prrejui

Dear Customer,

Your Annual subscription for NORTON 360 PROTECTION has been renewed & updated successfully.

The amount charged will be available within the next 24 to 48 hrs on your account profile.

BILLING DETAILS]]]]]]]]]]]]]]]

INVOICE NUM @ INV80019PJC

PRODUCT NAME @ NORTON 360 PROTECTION

START DATE @ 2022 Feb 07

FINISH DATE @ 1 year from Start Date

GRAND TOTAL @ $249.96 USD

PAYMENT METHOD @ Automatic Debit

If you wish to not to continue and claim a REFUND then please feel free to contact our Billing Department as soon as possible!]]]]]]]]]

You can Reach us on : +1 – ( 855 ) – ( 592 ) – 1827

Sincerely,
Billing Department
SB

This one used the phone number 855-592-1827.

What To Do If You Receive One of These Emails

The best course of action is to delete scam emails that make claims about Norton, renewals, and refunds.

For more details, we recommend visiting the company’s official website, Norton.com. The company published a page about these renewal refund scams.

They also listed several email addresses Norton has used to send official correspondence: norton@nortonlifelock.com, norton@secure.norton.com, ems@norton.com, lifelock@secure.norton.com, and information@mail.nortonstore.hk. These can be trusted, according to the company.

Curious about how Snopes’ writers verify information and craft their stories for public consumption? We’ve collected some posts that help explain how we do what we do. Happy reading and let us know what else you might be interested in knowing.