After gaining access to the user's bank account, they use software to obscure the screen, so the user cannot see what they are doing. If the recipient agrees and gives them remote access, they ask the user to log into their bank account, so they can cancel or reverse the transaction. Scammers claim that they can only cancel the subscription by accessing the recipient's device so that it doesn't renew or by reversing a transaction already made.

When the target attempts to cancel the subscription this way, the scam could take several forms.įirst, scammers try to convince their targets to grant them remote access to their laptops or computers. The scam begins when someone calls the given number to seemingly avoid being charged for something they don't want. In rare instances, they may further inform their targets that the subscription has already been renewed, and that their account has been debited.Īfter making victims panic, scammers instruct them to contact their billing department by calling the number provided to cancel the subscription or get a refund for the amount deducted (which hadn't actually been charged anyway). Using an official logo and professional-looking design, cybercriminals make the email appear authentic.īesides that, scammers also include a fake invoice and mention a NortonLifeLock subscription that will be renewed within 24 hours.

The scammers add a fake custom ID, invoice number, and renewal date to make the email appear genuine. They present the email as an official notification from NortonLifeLock, a real cybersecurity software company. The NortonLifeLock subscription renewal scam is an email scam in which cybercriminals send a fake notification email to recipients about the renewal of an antivirus system.

Norton lifelock