Identifying Norton 360 Refund Frauds: A Close Look at the MalwareFox Phishing Scheme

Have you received an email purportedly from Norton informing you that your subscription is about to expire? It could be a scam. Here’s what you should know.

We called the number and noticed that it connects to the scammer in a foreign nation. Their sole objective is to get your Credit Card and Personal identity details.

Disclaimer: This post includes affiliate links

If you click on a link and make a purchase, I may receive a commission at no extra cost to you.

What is Norton 360 Renewal / Refund Scam?

The Norton 360 Protection subscription refund scam is an email scam in which cybercriminals send recipients a bogus notification email about the renewal of their subscription. They present the email as an official notification from the cybersecurity software company NortonLifeLock.

To make the email appear genuine, the scammers include a fake custom ID, invoice number, and renewal date. Cybercriminals make the email appear authentic, from the official logo to the professional-looking email design.

A proforma invoice is presented in the email which states that the billing amount (from $300-$999 USD) will be deducted from the recipient’s credit card. In some cases, scammer might inform that the money has been already deducted.

After striking fear in their victims, scammers instruct them to contact their billing department by dialling the number provided in order to cancel the subscription or obtain a refund for the amount deducted (which had not actually been charged).

Scam begins once the mentioned phone number is dialled. This is similar to GeekSquad Email scam which asks victims to cancel their subscription.

How Norton LifeLock Scam Works?

+1 – (808) – (318) – 2852 was the phone number listed in some of the Norton scam emails. We dialled the number, knowing full well that it was all a con job. We were connected to a scammer who was possibly in a foreign call centre. In the email, the scammer requested the invoice number.

This is referred to as a refund scam. The emails claimed that a payment to renew a Norton subscription had been successfully processed. However, this was merely a ploy to set up the scam.

In some cases, scammer might ask for remote access to the victim’s computer. It is done by suggesting that the billing cancellation is only possible through the recipient’s device. Depending on how the conversation goes, cyber criminals might insist on connecting to fix some technical problems (which aren’t for real).

Fake Tech Support Scams - How to Protect Yourself

How to identify Norton Refund Scam?

To examine the fake / genuineness of the email, ask yourself few questions:

1. Are you really subscribed to the mentioned product?
2. Does the domain of the sender’s email address matches the company name?
   In this case, it should be from @norton or @nortonlifelock
3. Does the charges and email address matches with the one you mentioned on subscription?

If the answers to above questions is NO, you can safely ignore the email and move on.

In some cases, the email sender’s domain was @gmail while the CCed email address was nortoncc1.2022@outlook.com

An official email notification will never use @gmail or @outlook email address so that’s a red flag.

Click here

What to do if you have received Norton Renewal Scam email?

When you receive a scam email, the first thing you should do is confirm that it is a scam. So, as you read, keep an eye out for the above-mentioned indicators.

No matter how official the number appears, do not download attachments or contact it. Click no suspicious links in the email, even if they claim to allow you to cancel your subscription.

If scammers request remote access, refuse. Similarly, if the scammers claim that a transaction to renew the subscription has already occurred, contact your bank instead of contacting the scammers.

If you are still unsure despite having seen all of the warning signs, you can contact Norton support (this is a genuine link) for confirmation. Ignoring the email after Norton’s support team confirms that no such invoice has been generated, indicating that it is a scam, is the best course of action.

What to do if you have fell for Norton LifeLock Subscription Renewal Scam?

• If you’ve only spoken with the scammer, refuse to grant them remote access.
• Turn off your internet if you’ve granted scammers remote access so they can’t connect to your computer if they’ve already installed the tracker. Also, before re-enabling your internet connection, scan your computer for malware and hijacking software.
• If they have access to your laptop’s webcam, your privacy could be jeopardised. Temporarily disable your webcam.
• Scammers may claim to have transferred an extra amount during the transaction reversal and request that you reimburse them. Don’t be taken in by this.
• If scammers have accessed your bank account, contact your bank and request that it be frozen.

What to do after being Scammed?

Also read: