Norton renewal invoice scam
An email claims a Norton or LifeLock subscription was auto-renewed and a sum charged, and gives a phone number to cancel. Same mechanics as the Geek Squad family with a different brand skin; Norton documents the pattern on its own support site.
- Impersonates
- Norton
- Arrives by
- First seen
- not dated
- Specimens
- 0
- Updated
- 2026-09-02
Right now what this family looks like
How to recognise it
- A renewal you never bought, with a large round amount
- The only way to "cancel" is to call
- Sender is not a Norton domain
What to do
- Do not call, do not reply, delete it
- If you are a Norton customer, check your subscription by typing norton.com yourself
- Nothing was charged
Already called, clicked or paid? what to do in the next hour
- Gave remote access? Disconnect from the internet, uninstall the tool they had you install, change passwords from another device
- Paid by card or bank transfer? Call your bank now and dispute it. Gift cards? Call the card issuer with the card numbers
- Expect a call-back from a "refund department" — that is act two of the same scam. Hang up
How it changed
nothing to compare yet · no specimen on recordGot a version? A new subject line, sender, number or domain becomes the next point on this line. Redacted before publication. Send it →
02 Sept2026
Registry
Family created
Opened at launch from the pattern Norton itself documents; no dated specimen on record yet — send yours.
Same trick, other brands
- Geek Squad renewal invoice scamactive · 2026-09
- McAfee renewal invoice scamactive · 2026-09
Indicators
- None on record yet. Indicators change weekly; an empty list never means an email is safe.
In other streams
- Nothing yet.
Registry data
- Machine-readable
/scams/norton-renewal-invoice.json- Timeline feed
/scams/norton-renewal-invoice/feed.xml- Sources
- 1 · 1 change logged
- Licence
- CC BY 4.0 · attribution required
- Created / updated
- 2026-09-02 / 2026-09-02