PayPal Norton Invoice Scam and Call Cancellation

A Sample of an Invoice Scam

$407.14 billed for Norton. Full refund available – cancel within 4 hours.

Monday 10 August 2026 at 15:00 UTC

Dear customer, your Norton subscription has auto-renewed for $407.14 via auto-debit from your bank.

To cancel auto-renewal, call ＋ｌ （８３１）５２９－８７４８. For help, PayPal helpline ＋ｌ （８３１）５７６－７３２６.

Your Norton antivirus plan has been renewed for $407.14. Order #NRT45219.

Call ＋ｌ （８３１）５２９－８７４８ or ＋ｌ （８３１）５７６－７３２６ to dispute.

８３１-５２９-８７４８

８３１-５７６-７３２６

How the Scam Works

• The Fake Alert: You receive a real email from a genuine address like service@paypal.com. Scammers exploit PayPal's built-in billing tools to generate official invoices for nonexistent products, like a $299–$400 Norton antivirus subscription.
• The Panic Trigger: The message claims you have been charged or that your subscription will auto-renew within 24 hours. Because you didn't buy anything, your immediate instinct is to look for a way to cancel it.
• The Trap: The text contains a fake "customer service number" to dispute the charge. If you call, a fraudster will pretend to give you a refund. Instead, they will try to coerce you into downloading remote-access software (like AnyDesk or TeamViewer) or hand over your bank login credentials.

What You Must Do Now

1. Do not call the phone number listed in the email or click any links inside the notification.
2. Check your official accounts independently. Go directly to PayPal or your online banking app via a separate browser window to check your actual history. You will see no real money has left your account.
3. Report the scam invoice. Do not pay it. Log into PayPal, click on the fraudulent pending invoice, and select the option to cancel or report it as spam.
4. Forward the email. Send copy of the deceptive message directly to phishing@paypal.com and spam@norton.com to alert their security teams.

Already Interacted with Them?

• If you called and gave bank data: Call your financial institution's official fraud hotline immediately to lock down your accounts and cards.
• If you granted computer access: Disconnect your device from the internet right away, uninstall the remote software, and run a thorough malware scan.