Norton LifeLock scam: how to spot it and what to do

The Norton LifeLock email scam is a fraudulent campaign delivering fake invoices claiming users have purchased Norton LifeLock Family Security services. The scam emails impersonate legitimate companies but contain false information and are not affiliated with NortonLifeLock Inc. in any way. Messages claim payment has already been processed and demand immediate action to cancel fraudulent subscriptions.

A fake phone number—1 (856) 291-0622—directs victims to call for cancellation, though no actual payment was made. The emails display false invoice details including fabricated addresses, invoice numbers, and charges of $349.85 to $449.99. The scam's goal is tricking victims into calling the number so scammers can gain remote access to steal sensitive information like banking credentials.

No, Norton LifeLock is not charging your account, and the email invoice is completely fake. The scam email falsely claims payment has been processed when no legitimate transaction occurred.

Scammers create fabricated invoice details to create urgency and panic, pressuring you to call the fake support number immediately. Your actual bank and credit card accounts are not charged by Norton or NortonLifeLock based on these fraudulent emails alone.

However, if you call the number in the email or provide remote access to your computer, scammers may gain access to your accounts and steal money directly. Always verify charges by checking your actual bank statements rather than trusting unsolicited email invoices.

Calling the phone number provided is exactly what scammers want you to do, as it allows them to manipulate you into providing sensitive information or granting remote access to your computer.

Once you call, scammers can use social engineering tactics—pretending to be technical support or payment processors—to convince you to provide banking details, passwords, or credit card information. They may claim they need remote access to 'verify' your information or 'cancel charges,' then use that access to steal data or install malware.

Scammers can manipulate what you see on your screen during remote sessions using HTML editing techniques, creating fake bank pages that capture your login attempts. Never call unsolicited numbers from emails, even if the sender appears legitimate.

Scammers aim to steal banking login credentials, credit card information, personal identification details, and access to your computer system. The email specifically mentions PayPal payment processing in some variants, suggesting scammers may target PayPal and online banking login information.

By gaining remote access through misleading support claims, they can monitor your screen, capture keystrokes, and harvest all information visible on your system. Social Security numbers, driver's license information, and other personally identifiable data are valuable for identity theft.

Once obtained, this information can be used for fraudulent purchases, account takeovers, and financial exploitation. Some victims report additional scam attempts after the initial contact, suggesting their information is sold or shared among criminal networks.

Verify directly with Norton or NortonLifeLock through their official website or customer service line—never use contact information from suspicious emails. Check if you actually subscribed to Norton LifeLock; if you didn't purchase this service, any invoice is definitely fraudulent.

Examine the email sender address carefully; scam emails may use addresses that look similar to legitimate ones but contain subtle misspellings. Legitimate companies never request immediate payment confirmation through email links or phone calls.

Hover over links in emails to verify the actual destination URL before clicking. Grammar, formatting inconsistencies, and generic greetings like 'Dear Payment' rather than your actual name indicate scam emails. Official invoices from real companies include specific details about your actual purchase, subscription type, and billing history.

Do not call the number in the email or click any links. Report the email to the phishing departments of your email provider and Norton LifeLock's official support channels. Delete the email and mark it as spam to prevent similar messages.

Verify your bank and credit card accounts have not been compromised by checking statements for unauthorized transactions. Change passwords on important accounts from a clean device if you're concerned about compromise. If you accidentally called the number or provided any information, contact your bank and credit card companies immediately to alert them to potential fraud.

Monitor your credit reports for suspicious activity, and consider placing a fraud alert with credit bureaus if personal information was compromised. Keep records of all scam communications for potential law enforcement reporting.

Be extremely cautious with unsolicited emails claiming to be from Norton or any security company. Legitimate Norton communications typically arrive through their official website, secure customer portals, or phone calls you initiated.

If you have an active Norton subscription, log into your official account directly through their website to check for legitimate billing notifications rather than trusting email links. Real Norton invoices include your actual account information, subscription details, and allow you to verify purchases through your user dashboard.

When in doubt, contact Norton's official support number from their website rather than calling numbers provided in emails. Cybercriminals frequently impersonate legitimate companies in phishing campaigns, making email addresses easy to forge. Never assume an email is legitimate based on appearance alone; always verify independently.

Remote access scams are particularly dangerous because once scammers connect to your computer, they have full control over your system. They can view all files, passwords stored in browsers, and sensitive documents without your knowledge.

Scammers can manipulate what you see on your screen using screen-editing tools, creating fake bank pages or payment confirmations while capturing your actual login attempts. They may install malware, ransomware, or spyware for ongoing monitoring and control.

Financial losses can be severe, with victims losing thousands of dollars through direct transfers or fraudulent charges authorized through remote sessions. Even after disconnecting, residual malware left behind may enable continued unauthorized access. This makes remote access scams one of the most damaging types of computer fraud, requiring professional cleanup and comprehensive account security reviews.

Enable multi-factor authentication on all important accounts to prevent unauthorized access even if passwords are compromised. Keep your operating system and software fully updated to patch security vulnerabilities. Use reputable anti-malware software to detect and remove any malware from email attachments or malicious downloads.

Be suspicious of urgent requests for payment confirmation or account verification through email. Verify company contacts through official websites rather than using information from emails or phone calls you received. Create strong, unique passwords for each online account to limit damage from compromised credentials.

Educate yourself about common scam tactics and social engineering techniques used by criminals. Report scams to the FTC and your state's attorney general to help protect others. Never grant remote access to anyone unless you initiated the contact and verified they are from a legitimate support provider.

Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.

For Norton LifeLock scam, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.

Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.