Norton / LifeLock scams
Last updated September 18, 2026
The short answer
Norton and LifeLock scams involve fake subscription renewal emails claiming you're being charged $300-$500 for a product you never ordered. The email includes a phone number to "cancel." Calling connects you to a scammer who requests remote access to your computer and steals money from your bank account. Norton will never send unsolicited invoices or ask for remote access to process a refund.
The Norton/LifeLock renewal scam is one of the most common email scams targeting consumers, especially seniors. Scammers send fake invoices for Norton AntiVirus or LifeLock identity protection, hoping victims will call the "cancellation" number. The scam is especially effective because Norton is a well-known security brand, and many people have had Norton products at some point.
How Norton / LifeLock scams work
- 1
Fake renewal invoice email
You receive a professional-looking email with a PDF or HTML invoice saying your Norton or LifeLock subscription has been auto-renewed for $349.99 or similar. The charge will post to your account within 24 hours.
- 2
You call the "cancellation" number
The invoice includes a toll-free number. The person who answers identifies as Norton Support and says they can process a cancellation and refund.
- 3
Remote access and fake refund
They ask you to install AnyDesk, TeamViewer, or another remote access tool so they can "process the refund." Once connected, they ask you to log into your bank account to "verify the refund."
- 4
Money stolen from your bank
While watching your screen, the scammer edits the page HTML to make it look like they accidentally refunded too much (e.g., $3,499 instead of $349). They pressure you to send back the "excess" via wire transfer or gift cards. In reality, no refund was ever sent.
Warning signs
- An email says your Norton or LifeLock subscription auto-renewed for $300-$500
- You don't have a Norton or LifeLock subscription
- The email asks you to call a phone number to cancel
- The "support agent" asks you to install remote access software
- They ask you to log into your bank account during the call
- They claim they refunded too much and need you to send money back
Examples
Norton $499 renewal scam
You receive an email invoice for "Norton 360 LifeLock Ultimate Plus" at $499.99. You never ordered this. You call the number and the agent says they need to connect to your computer via AnyDesk to process the cancellation. Once connected, they show you a fake "refund" screen, claim they sent $4,999 instead of $499, and pressure you to buy $4,500 in gift cards to "return the excess."
LifeLock identity protection renewal
An email says your LifeLock membership renewed for $349 and provides an invoice number. The email looks legitimate with Norton LifeLock branding. You call to cancel, and the agent asks for remote access. While screen-sharing, they direct you to your bank account and silently transfer money to themselves.
What to do
- Delete the email. If you don't have a Norton/LifeLock subscription, the invoice is fake.
- If you do have a subscription, verify at my.norton.com or through the Norton app, not by calling numbers in emails.
- If you gave remote access, disconnect from the internet immediately and run a virus scan from a clean device.
- If you sent money or gift cards, contact your bank and the gift card company immediately.
- If the scammer accessed your bank account, contact your bank to freeze accounts and change all passwords.
Report it to Norton / LifeLock
Forward fake renewal invoices to spam@norton.com. Your real subscription status is only ever in your Norton account.
Getting your money back
If a scammer accessed your bank account via remote access, contact your bank immediately to report fraud and freeze your accounts. Change all passwords from a clean device (not the one the scammer accessed). If you purchased gift cards, call the gift card company with the card numbers. They may be able to freeze the remaining balance. File a report with local police.
Frequently asked questions
Is a Norton renewal email real?
If you don't have a Norton subscription, any renewal invoice is fake. If you do have a subscription, check your account directly at my.norton.com or through the Norton app. Norton does not send invoices with phone numbers to call for cancellation.
What should I do if I installed remote access software for a scammer?
Immediately disconnect from the internet. Uninstall the remote access software (AnyDesk, TeamViewer, etc.). Run a full antivirus scan. Change all passwords from a different, clean device. Contact your bank if you logged into any financial accounts during the session.
Why do scammers use Norton and LifeLock specifically?
Norton and LifeLock are widely recognized security brands, so the invoices seem plausible. Many people have had Norton products at some point. The security branding also creates ironic urgency, since people worried about identity theft are more likely to call about an unfamiliar charge.
Other companies scammers impersonate
Scams reuse their scripts across brands. If you were contacted about Norton / LifeLock, these are the guides worth reading next.