Impersonation Scams
Norton Scam Emails: How to Spot Them
A Norton antivirus renewal charge you never approved is almost always a refund scam. Here is how to check it in a minute.
Quick answer
Do not call the number in the invoice. Check your card statement instead: if there is no charge, the invoice is fake and you can delete it. Genuine Norton subscription details are visible when you sign in at norton.com by typing the address yourself. The scam's goal is a phone call that leads to remote access to your computer and a staged refund 'error' you are then asked to repay.
Warning signs to look for
- An auto-renewal confirmation for antivirus you do not use
- A billing or cancellation phone number instead of a working account link
- An invoice delivered as a PDF or image so scanners cannot read it
- Amounts designed to alarm — often between $300 and $600
- Sender addresses on free mail providers or unrelated domains
- A warning that your device is unprotected unless you act today
Why antivirus brands are used
Security software is the perfect cover story. Almost everyone has heard of Norton, subscriptions really do renew automatically, and a renewal charge is plausible enough to prompt action without being memorable enough to verify. The email is also easy to make convincing because it contains no confidential detail — just an order number, a price, and a number to call. Fear of both the charge and being 'unprotected' pushes people to dial.
The refund-reversal mechanics
On the call, the agent offers to cancel and refund. They ask you to install a remote-access tool so they can complete the process, then have you sign in to online banking. Using screen manipulation, they make it look as though they transferred far more than the refund amount and ask you to return the difference by transfer, gift cards, or cash. Nothing was ever refunded, and the money you send is gone. A variant simply reads your saved passwords and card details while they have access.
How to check in one minute
Open your bank or card statement and search for the amount or the merchant. No charge means nothing happened. If you do use Norton, sign in at norton.com by typing the address yourself and look at your subscription and billing history — genuine renewals are listed there. Never use contact details from the email. If a real charge exists that you did not authorise, dispute it through your card issuer on the number on your card.
What the company advises
Gen, the company behind Norton, publishes guidance on tech-support and refund scams and asks customers to report impersonation rather than call numbers in unsolicited invoices. The general rule, consistent with FTC advice, is that legitimate software companies do not need remote access to issue a refund and never ask for repayment in gift cards.
If you already called
Disconnect the computer from the internet, uninstall any remote-access software, and run a full antivirus scan with the security tool you already have. Change your banking and email passwords from a different device, and check for mail-forwarding rules that may have been added. Call your bank on a trusted number and tell them someone had remote access during a banking session. Report to the FTC at reportfraud.ftc.gov and, if money was sent, to the FBI at ic3.gov immediately.
When you cannot tell
Forward the invoice to check@spamcheck.com before calling anyone. SpamCheck will tell you plainly whether it is a genuine renewal notice or the refund scam, and what your next step should be.
SpamCheck is not affiliated with or endorsed by the companies mentioned in this guide. Brand names are used only to help consumers identify potential impersonation scams.
Frequently asked questions
- I do use Norton. How do I know if my renewal is real?
- Sign in at norton.com by typing the address and check your subscription and billing history, and compare with your card statement. Never rely on the email itself.
- The invoice was an image with no links. Is that unusual?
- No, it is intentional. Images and PDFs hide text from filters, and the payload is the phone number rather than a link.
- Can they charge me just because I opened the email?
- No. Opening an email cannot create a charge. Only a real payment method being used can, which is why the statement check settles it.
- Is SpamCheck affiliated with Norton?
- No. SpamCheck is independent and is not affiliated with, sponsored by, or endorsed by Norton or Gen Digital. The brand is named only to help identify impersonation.
Sources
SpamCheck provides informational risk assessments and cannot guarantee that any message is completely safe. When money or sensitive information is involved, independently contact the organization using a trusted phone number or website.
About SpamCheck
SpamCheck helps people understand suspicious emails by letting them forward the message to check@spamcheck.com and receive a plain-English analysis. This guide was published by SpamCheck and written and reviewed by the SpamCheck Editorial Team.
Related guides
McAfee Scam Emails: How to Spot Them
McAfee impersonation comes in two flavours: a renewal invoice and an 'your protection has expired' warning. Both want the same thing.
Geek Squad Scam Emails: How to Spot Them
A Geek Squad invoice for a subscription you never had is one of the most common scam emails in circulation. Here is what it is really after.
Microsoft Account Scam Emails: How to Spot Them
Fake Microsoft security alerts and 'your PC is infected' pop-ups both lead to the same place. Here is how to check what is real.
Fake Invoice Emails: How to Spot Them
Invoice scams work because paying bills is normal. Here is how to check any unexpected invoice before money moves.
10 Things Scammers Say (Word for Word)
Scam scripts are recycled across thousands of criminals. Learn these ten exact phrases and you'll recognize the play in the first sentence.
Amazon Scam Emails: How to Spot Them
Fake order confirmations and Prime renewal notices are designed to make you call. Here is how to check any Amazon message in under a minute.