Scam library · Email & phishing · Tech support
Norton antivirus renewal scam
The email looks like a Norton receipt: a logo, an order number, and a charge of $299 to $499 for a subscription that 'auto-renewed today'. To dispute it, call the support number.
Real Norton products exist on millions of computers, which is why scammers use the name. But the email isn't from Norton, and the number reaches a call center run by scammers.
What the message looks like
From: Norton Support <billing-dept@nortonrenewals-secure[.]com>
Subject: Your Norton 360 Deluxe subscription has been renewed
Order ID: NRT-118294 · Amount charged: $349.99 · Term: 3 years
Your subscription has been automatically renewed. Payment will appear on your statement within 24 hours.
To cancel and get a refund, contact our billing team: 1-877-555-0108
How this scam works
When you call, the 'agent' asks for remote access to process a refund, then shows a fake over-refund and asks you to send the difference back. Some versions skip the refund and simply ask for your card to 'reverse the charge', or sell you a fake support plan.
Many of these emails arrive as a PDF or image so spam filters can't read the text. Some come from a real but hacked email account, so the sender name alone doesn't prove anything.
The safe check never involves the email: your real Norton subscriptions are listed when you sign in at my.norton.com, and any real charge shows on your card statement.
Red flags
- A charge for a product you don't use, or a price that's far higher than what you paid before.
- A sender address not on norton.com, or a free email account.
- A phone number to call for a refund.
- A PDF or image invoice instead of a normal receipt.
- Pressure: the refund window closes 'within 24 hours'.
How to tell it’s fake
- Look at your card or bank statement for the charge before doing anything.
- Sign in at my.norton.com by typing the address yourself and check your subscription.
- Search the phone number online. Many scam numbers are already reported.
What to do if you clicked, paid or shared info
Don’t panic, and don’t blame yourself. These scams are built by professionals. Act quickly, one step at a time.
If you clicked a link or called back
- If you called but didn't give access, hang up. Don't call back if they keep calling.
- If they connected to your computer, disconnect it from the internet, remove the remote tool and have the computer checked.
If you paid
- Call your bank or card issuer immediately using the number on the card. Report any wire, Zelle or gift card payment as fraud.
If you shared personal info, a password or a code
- Change your email and banking passwords from another device and turn on two-step verification.
Where to report and get help (U.S.)
If a message seems legit and you’re still not sure, get a second opinion before you act. Reporting helps stop scammers, even if money can’t be recovered. If you are in danger, call 911.
- Your bank or card issuer
Call the number on the back of your card or on your statement, not one from the message. Ask them to stop or reverse the payment and to watch the account. - Federal Trade Commission (FTC) · ReportFraud.ftc.gov
Report the scam and get a step-by-step recovery plan. - FBI Internet Crime Complaint Center (IC3) · ic3.gov
Report scams that happened online, especially if money was lost. Include phone numbers, websites and payment details. - AARP Fraud Watch Network Helpline · aarp.org helpline
Free, for anyone of any age: trained volunteers help you sort out next steps. 877-908-3360, Monday to Friday, 8 a.m. to 8 p.m. Eastern. - IdentityTheft.gov · IdentityTheft.gov
If you shared your Social Security number or someone opened accounts in your name.
How Gmork Scam Guard would warn you
Scam Guard runs in Chrome and Edge on your computer. When a page suddenly fills the screen, plays alarms or claims your computer is infected, it recognizes the pattern of a fake support warning and tells you, in plain words, that it's safe to close the tab. In a renewal email you have open in Gmail or Outlook on the web, it points out the lookalike sender and the call-this-number trick. If a message seems legit and you're still unsure, get a scam expert's second opinion before you call anyone.
Scam Guard can miss things, so the checks above still matter. See what it warns about and what it keeps private.
Questions people ask
- Does Norton charge $399 to renew?
- Prices vary, but real renewals show in your Norton account and on your statement. If neither shows a charge, the email is fake.
- Why does the email have a PDF?
- Image and PDF invoices hide the text from spam filters. That's a common sign of these scams.
- Should I reply to say I didn't order it?
- No. Replying or calling confirms you're a real person. Delete it and check your account yourself.