Norton Lifelock Scam Renewal

A Sample of the Scam

How the Scam Works

Scammers typically use a "Refund Scam" or "Auto-Renewal Scam" model:

• The Hook: You receive an email or text message claiming your Norton or LifeLock subscription has been renewed for a high amount (often between $300 and $600).
• The Panic: The message uses urgent language, stating you have a limited time (e.g., 12–24 hours) to cancel the "unauthorized" charge.
• The Trap: To cancel, you are told to call a provided phone number or click a link.
  • If you call: A scammer posing as tech support will ask for your credit card or bank details to "process a refund". They may also try to convince you to download remote access software (like AnyDesk or TeamViewer) to "help" you, which allows them to steal files or install malware.
  • If you click: You are often sent to a spoofed login page designed to steal your credentials.

Red Flags

• Generic Senders: The email address often comes from a random Gmail, Outlook, or nonsensical domain rather than an official @norton.com or @lifelock.com address.
• Urgent Threats: Language like "immediate action required" or "your account will be charged" is used to make you act before thinking.
• Grammatical Errors: Many scam emails contain spelling mistakes, strange punctuation, or awkward phrasing.
• Unsolicited Contact: Norton will never call you out of the blue to fix your computer for money.

Received a Scam

1. Do Not Respond: Do not click links, open attachments, or call the phone number provided in the message.
2. Verify Directly: If you're worried about a charge, go directly to the official Norton website and log in to your account to check your subscription status.
3. Report It: Forward the suspicious email as an attachment to spam@norton.com or spam@lifelock.com.
4. If You Already Shared Info:
   • Immediately contact your bank to freeze your accounts or contest the charge.
   • Change your passwords for your Norton account and banking apps.
   • Run a full system scan using legitimate antivirus software if you granted remote access or clicked a link.