Skip to content

Companies

Norton LifeLock scams: how the fake messages work

Norton and LifeLock brand impersonation scams involve fraudulent emails, text messages, and pop-up warnings falsely claiming that a victim's cybersecurity subscription has automatically renewed for hundreds of dollars or that their identity has been compromised in a data breach. Scammers distribute these alerts via phishing emails and toll-free phone numbers to induce panic, coerce victims into calling fake support centers, and steal financial credentials or remote computer access.

Last reviewed: August 9, 2026  ·  Drafted with AI assistance. Every figure on this page was checked against the source cited for it. Not yet reviewed by a human editor.

ScamPreventionGuide is an independent consumer-protection resource. We are not affiliated with, endorsed by, or sponsored by Norton LifeLock. Company names and trademarks are the property of their respective owners and are used here only to identify the companies that scammers impersonate.

01

Is the Norton LifeLock message real?

Norton and LifeLock contact customers via official domains ending in @norton.com, @lifelock.com, or @nortonlifelock.com. Genuine notifications regarding billing and subscriptions direct users to sign in at my.norton.com. Norton never calls or sends unsolicited SMS messages demanding immediate remote access to computers, demanding cryptocurrency or gift card payments, or claiming automatic charges of hundreds of dollars without a prior renewal confirmation.

According to Federal Trade Commission (FTC) data published in June 2026, consumers reported losing $3.5 billion to imposter scams in 2025, with reported losses increasing nearly three times since 2020 across more than 1 million total imposter scam reports. Source: FTC Data Show People Reported Losing $3.5 Billion to Imposter Scams in 2025.

02

Which versions are in circulation?

The versions in circulation, and what each one is after:

VersionHow it reaches youWhat it wants
Fake Subscription Auto-Renewal InvoiceEmailCall center phone number to initiate a tech support / refund scam where remote access software is installed.
Dark Web Identity Theft AlertEmailCredentials harvesting, personal identifying information (PII) theft, and financial account takeover.
Fake Antivirus Expiry & Virus Detected Pop-upPop-up / Browser NotificationInduce panic, trick victim into calling fake support, downloading remote access trojans (RATs), or buying useless software keys.
LifeLock Credit Freeze ScamSMS / PhoneSocial engineering, extracting banking credentials, or tricking victims into transferring funds to "safe accounts".
03

What do the fake messages actually say?

We are not quoting example wording on this page. The wording we had was attributed to a source that does not contain it, so it was removed on 16 August 2026 rather than reworded. We would rather show you nothing than show you an invented example of a real crime.

What matters more than the exact wording is the shape: an unexpected message about a renewal or charge you do not recognise, an amount designed to alarm you, and a phone number or link supplied for you to use. Do not use either. Reach Norton through the app or through norton.com the way you normally would.

04

How can you tell a real message from a fake one?

The differences you can check yourself:

  • The genuine sender address ends with @norton.com or @lifelock.com, whereas scam emails originate from free webmail services (@gmail.com, @outlook.com) or unrelated third-party domains.
  • Authentic Norton renewal emails address the customer by their registered first and last name or display the correct partial account details, while scam emails use generic headers like *"Dear Customer"* or *"User"*.
  • Scam invoices feature urgent warnings of immediate multi-hundred-dollar charges and list phone numbers for billing disputes, whereas genuine Norton bills direct customers to log into my.norton.com.
  • Genuine Norton or LifeLock support technicians never ask customers to download third-party remote control software (such as AnyDesk or TeamViewer) via unsolicited cold calls or pop-ups.
  • Scammers instruct victims to pay cancellation or refund processing fees via cryptocurrency, wire transfers, or retail gift cards — methods never utilized by Gen Digital billing departments.
05

What should you do in the first hour?

It depends on how far it got. Find your situation:

  • Do not engage further, block the phone number or email address, and forward the scam message to spam@norton.com (for Norton) or spam@lifelock.com (for LifeLock).
  • Immediately log into your official Norton account at my.norton.com to change your password, enable multi-factor authentication (MFA), and place a temporary credit freeze with the major credit bureaus (Equifax, Experian, TransUnion).
  • Immediately contact your bank or credit card issuer to dispute the fraudulent charges, report the transaction as unauthorized, and request a chargeback or account freeze.
  • Disconnect the computer from the internet immediately (unplug Ethernet or disable Wi-Fi), run an offline antivirus scan using trusted security software, and inspect installed applications for unfamiliar remote-control tools (AnyDesk, TeamViewer, UltraViewer) to uninstall them.
06

Where do you report it?

Whatever the brand, two official channels take the report. File with the US Federal Trade Commission at reportfraud.ftc.gov, and — if money was lost or a computer was accessed — with the FBI's Internet Crime Complaint Center at ic3.gov. Reporting rarely recovers money on its own; it is what makes the next person's warning possible.

07

Sources