Scam of the day – January 9, 2022 – Phony Norton Life Lock Invoice

by | Jan 8, 2022 | Scam of the day

The phony invoice scam is a common scam popular with scammers because it is quite effective.  It starts when you receive an email that purports to be from a popular company with which many of us do business that indicates that you owe them a significant payment.   The scammers count on people being concerned that they are being wrongfully charged for a product they did not order.  You are provided a telephone number to call if you dispute the bill. If you call the number, you will be prompted to provide personal information that will be used to make you a victim of identity theft.

The copied email below, which I personally received, appears to come from Norton Life Lock, a company that provides a wide range of digital security services and identity theft protection services.   As always, the purpose of a phishing email is to lure you into clicking on links contained within the email or providing personal information, in this case by phone if you call to dispute the phony bill . If you click on links in phishing emails, you end up downloading malware and if you provide the requested information, it ends up being used to make you a victim of identity theft. This particular phishing email provides a phone number to call if you wish to dispute the obviously phony invoice.  If you call the number in the phishing email you will be asked for personal information that will be used to make you a victim of identity theft.  The phone number is not one of Norton Life Lock.  The real phone number of Norton Life Lock is 800-543-3562.

There are a number of red flags that indicate that this is a scam.  Your name does not appear anywhere in the invoice.  Only your email address appears in the phony invoice.  Also, the email was sent from an email address that has no relation to Norton Life Lock.  Finally, the email provides what it says is a toll free number to call if there are any issues with the invoice, but the area code 432 which is indicated in the email is not a toll free number, but rather an area code used in Texas.

Here is a copy of the invoice being circulated.

Norton Logo
Thank you for trusting NortonLifeLock for your Cyber Safety needs.
You are almost done!
Hi User,
Your Order Number NP1338685316 for $ 514.48 is now complete. Your order details are shown below and are stored in your NortonLifeLock account.
Norton™ 360 with LifeLock™ Select
You must download and install Norton™ 360 with LifeLock™ Select on each device that you want protected. Please follow these simple steps:
  1. Download your NortonLifeLock subscription by clicking on the “Get Started” button or go to your Norton account
  2. Follow the instructions to install your NortonLifeLock service on one or more devices

You have just joined over 5 million other LifeLock Members.

IF YOU HAVE NOT DONE THIS PURCHASE , CONTACT AT OUR CUSTOMER SUPPORT DESK TOLLFREE NUMBER

DO NOT REPLY ON THIS EMAIL

TOLLFREE +1(432) 614-5254

Your subscription is active and will renew on January 02, 2023 for $ 499.48/ year + applicable tax

— Your NortonLifeLock Team
Order Number: NP1338685316
Payment Method: Credit Card
Billing Date: JAN 03, 2022
Product Information
Price: $ 499.48

Norton™ 360 with LifeLock™ Select

Product Key: X6CWKYBY9KFRY94GJGJWK6QGD
Serial Number: 29GYQ7FQKRX9
1 year(s) protection for up to 5 device(s) and 100GB backup storage
Subscription Service with Download – Qty: 1
Annual Subscription & Automatic Renewal Payment Authorization
Your 1 year subscription is now active and includes the purchase of an annual subscription which automatically renews. By subscribing, you authorized NortonLifeLock to automatically charge from your Credit Card & the applicable annual renewal price (plus applicable taxes), before each renewal, unless you cancel.
SubTotal: $ 499.48
Tax: $ 15.00
Total: $ 514.48
You have agreed to have the information and payment details stored in your NortonLifeLock account for subscription management and renewal purposes.
Tax Disclosure
Seller’s details:
NortonLifeLock Inc.
60 E. Rio Salado Parkway, Suite 1000, Tempe, AZ  85281, USA
USA FEIN:  77-0181864
Canada GST #:  12801 3208 RT0001; QST #:  1211858032
You have received this email as a service message from NortonLifeLock regarding the status of your NortonLifeLock product subscription

Copyright © 2021 NortonLifeLock Inc. All rights reserved.

NortonLifeLock Inc. 60 E Rio Salado Pkwy STE 1000, Tempe, AZ 85281, United States

TIPS

Once, I received a large invoice from a company with which I do business for goods I did not order, but rather than click on the link provided in the email, I went directly to the company’s website to question the invoice.  When the website came up, the first thing I saw was a large announcement that the invoice was a scam and that many people had received these phony invoices.  If you ever receive a phony invoice such as this and you think that it may possibly be true, don’t click on links or call phone numbers provided in the email.  Rather, contact the real company directly at a phone number or website that you know is legitimate where you can confirm that the phishing invoice was a scam.

Never click on links or download attachments in emails or text messages unless you have absolutely confirmed that they are legitimate and don’t call companies at telephone numbers that appear in the email such as this one.  Instead, if the email appears to come from a legitimate company, you can call them at a telephone number you confirm is legitimate .  Don’t call the number that appears in the email.  One of the indications that this is not legitimate and is a phishing email is the fact that the email address from which it was sent has nothing to do with Norton.   Most likely it is the email address of someone whose email account was hacked and made a part of a botnet used to send out these phishing emails.   The email does contain good graphics and the Norton Life Lock logo, but these are extremely easy to copy.

For those of you receiving the Scam of the day through an email, I just want to remind you that if you want to see the ever increasing list of Coronavirus scams go to the first page of the http://www.scamicide.com website and click on the tab at the top of the page that indicates “Coronavirus Scams.”  Scamicide has been cited by the New York Times as one of three top sources for information about Coronavirus related scams.

If you are not a subscriber to Scamicide.com and would like to receive daily emails with the Scam of the day, all you need to do is sign up for free using this link. https://scamicide.com/scam-of-the-day/