{
  "slug": "norton-renewal-invoice",
  "canonical_name": "Norton renewal invoice scam",
  "family": "fake-invoice-callback",
  "impersonates": {
    "brand": "Norton",
    "disclaimer": "Norton is not involved; criminals impersonate the brand.",
    "official_fraud_page": "https://support.norton.com/sp/en/us/home/current/solutions/v138341527"
  },
  "goal": [
    "callback",
    "remote-access",
    "payment"
  ],
  "channels": [
    "email"
  ],
  "summary": "An email claims a Norton or LifeLock subscription was auto-renewed and a sum charged, and gives a phone number to cancel. Same mechanics as the Geek Squad family with a different brand skin; Norton documents the pattern on its own support site.",
  "status": "active",
  "first_seen": null,
  "last_seen": null,
  "recognise": [
    "A renewal you never bought, with a large round amount",
    "The only way to \"cancel\" is to call",
    "Sender is not a Norton domain"
  ],
  "variants": [],
  "specimen": null,
  "tells": [],
  "indicators": {
    "sender_domains": [],
    "senders": [],
    "reply_to": [],
    "phone_numbers": [],
    "urls": [],
    "wallets": [],
    "attachments": [],
    "note": "Indicators change weekly; an empty list never means an email is safe."
  },
  "what_to_do": {
    "if_received": [
      "Do not call, do not reply, delete it",
      "If you are a Norton customer, check your subscription by typing norton.com yourself",
      "Nothing was charged"
    ],
    "if_called_or_paid": [
      "Gave remote access? Disconnect from the internet, uninstall the tool they had you install, change passwords from another device",
      "Paid by card or bank transfer? Call your bank now and dispute it. Gift cards? Call the card issuer with the card numbers",
      "Expect a call-back from a \"refund department\" — that is act two of the same scam. Hang up"
    ],
    "report_links": [
      {
        "label": "Report to the FTC",
        "url": "https://reportfraud.ftc.gov/"
      },
      {
        "label": "Report to FBI IC3",
        "url": "https://www.ic3.gov/"
      },
      {
        "label": "Norton: scams that use the Norton name",
        "url": "https://support.norton.com/sp/en/us/home/current/solutions/v138341527"
      }
    ]
  },
  "malware_family": null,
  "timeline": [
    {
      "date": "2026-09-02",
      "type": "registry",
      "title": "Family created",
      "text": "Opened at launch from the pattern Norton itself documents; no dated specimen on record yet — send yours.",
      "added": [],
      "removed": [],
      "sources": []
    }
  ],
  "related": [
    "geek-squad-renewal-invoice",
    "mcafee-renewal-invoice"
  ],
  "sources": [
    "https://support.norton.com/sp/en/us/home/current/solutions/v138341527"
  ],
  "legacy_urls": [],
  "legacy_redirect": false,
  "created": "2026-09-02",
  "updated": "2026-09-02",
  "changelog": [
    {
      "date": "2026-09-02",
      "text": "Record created at the registry launch."
    }
  ],
  "url": "https://soft2secure.com/scams/norton-renewal-invoice",
  "licence": "CC BY 4.0",
  "generated": "2026-09-03"
}