Norton scam emails: how to spot the fake renewal invoice
Quick answer
An email saying your Norton subscription was renewed and charged to your card, with a phone number to call if it was a mistake, is a scam. Norton is the company being imitated. Don't call the number. Check your card statement, and report the email.
- Comes by
- Email, Phone call
- Pretends to be
- Norton
- Last updated
How it works
Scammers send an email or PDF invoice that looks like a Norton renewal receipt. It says a charge, often a few hundred dollars, has gone through for antivirus or identity protection, and that you should call a "billing" or "cancellation" number right away if you didn't expect it.
The FTC describes this pattern: the number in the message connects you to a scammer, not to the company. Once you call, the person on the line may ask for card details to "verify" you, or ask you to install remote access software so they can "process the refund". With remote access they can see your screen and your accounts, install malware, or move money out of your bank. The FTC also notes that real tech companies don't contact you by phone, email or text to say there's a problem with your computer.
What they're after is money (a fake refund that turns into a transfer, or fees for worthless services), your card details, your logins, or control of your computer. The same script is used with other well-known names, including Geek Squad and McAfee.
Red flags
- A renewal or invoice for a product you don't remember buying
- A phone number to call, with pressure to call right away
- An email from a lookalike or free email address instead of Norton's own domains
- A PDF or image invoice instead of a message that points you to your Norton account
- A refund process that asks you to install remote access software
- Asks for card numbers, passwords or Social Security numbers by phone or email
Example message
Thank you for renewing your Norton subscription. Your card has been charged $[amount] for a 1-year plan. If you did not authorize this charge, call our billing department at [phone number] within 24 hours to cancel and get a refund.
What to do
- 1
Don't call the number or open the attachment
Don't reply, click [link] or open the invoice. The number in the message belongs to the sender, not to Norton.
- 2
Check the charge yourself
Look at your card or bank statement, and log in to your Norton account by typing the address into your browser. If there's no charge and no subscription, the email is fake. If you're unsure, use the support number from Norton's own website or your statement.
- 3
If you called, stop and don't install anything
If they asked you to install software, uninstall it, disconnect from the internet, and run a scan with security software you already trust. Then change the passwords for your email, bank and any account you opened while they were connected, from a different device.
- 4
If you paid or shared card details, call your bank
Use the number on the back of your card. Say it was fraud, ask them to block or reverse the payment and replace the card. If you sent money by transfer, gift card or crypto, tell the bank or the card company as well.
- 5
Report the email to Norton
Norton publishes a way to report scam emails on its support site: search for "report a spam or scam email" there and follow its steps, then delete the original.
- 6
Report it to the FTC
File a report at ReportFraud.ftc.gov. Outside the US, use your country's consumer protection or cybercrime reporting site.
Report it
Check if your details are exposed with Serus
Scammers find your number and address on data brokers and people-search sites. Serus removes them.
Why you got it
These emails go out in bulk, but the ones that feel believable use your real name and email, and sometimes your address or phone number. That information is easy to find on people-search sites and in data breaches. Serus finds the data brokers that list you and removes your details, and it alerts you when your email shows up in a breach, so fewer scammers can tailor a message to you. Our guide to what to do after a data breach covers the steps if your details leaked.
Frequently asked
Is Norton a scam?
No. Norton is a real security company, and scammers use its name in fake renewal emails. The FTC warns that scammers use names like Norton, McAfee and Geek Squad in fake renewal notices.
I got a Norton invoice but I do have Norton. Is it real?
Don't trust the email either way. Log in to your Norton account by typing the address yourself and check your subscription and billing there.
I called the number. What now?
Hang up, don't install anything, and if you gave card details call your bank. If you let them onto your computer, disconnect it, change your passwords from another device and run a scan.
Where do I report a fake Norton email?
Report it at ReportFraud.ftc.gov. Norton also has a page on its support site for reporting scam emails: search for "report a spam or scam email" and follow it.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
