Subscription order scams exposed!

Flexx

These spammers seem eager to be my friends, always trying to decide what's best for me without making me check anything myself. One even offered me Norton. How thoughtful!

Regards

Alexandru_BD

This one is a classic scam.

Scammers send spam emails saying that your Norton "account" is expiring or that it is time to renew your "subscription", or that the "subscription" has been already renewed. Various security vendors have been impersonated this way. This of course creates a sense of urgency by mentioning that the charge on the credit card has already been made. The fraudulent message may ask to call a bogus customer support number or urge you to click on a link. The goal is to steal your money or personal information.

There's an insightful article where Norton advises people who receive such emails to forward them as an attachment to spam@norton.com. Their article also displays a comprehensive list of legitimate Norton domains for reference, so that people who may receive such spam emails can identify them quicker. Here it is:

https://support.norton.com/sp/en/us/home/current/solutions/v71088498

Although that "invoice" is crafted to look like a genuine one, you can simply look at the sender's email address to spot the scam. Genuine emails and payment confirmations will never come from personal gmail addresses and don't arrive out of the blue.

Thanks for sharing this @Flexx

Flexx

https://community.bitdefender.com/en/discussion/comment/344711#Comment_344711

@Alexandru_BD, thanks for providing the Norton link related to legitimate emails from which Norton sends emails. I never knew there were so many genuine ones from Norton.

Regards

Flexx

It seems like different groups of spammers are in a race—the previous one sent me Norton, and the recent one sent me McAfee. For a moment, considering Norton is okay😅, but McAfee seriously😂—does it even stand a chance in the race?🤣

Regards

Alexandru_BD

Thanks, this gives us a detailed look on the red flags.

There's so much happening in this correspondence. First, there's "Jessica" using what's called a 'temporary email address generator' to send the bait, then you have the "account" details in the email body, which look more like a sequence of completely random numbers and letters, and once you open that invoice (people, don't try this at home, @Flexx is a seasoned user who knows how to protect himself), the first thing we notice is that "VISA Card Holder" and "Registered Email" fields are blank, because of course they are, since this is a template used for spamming, and if you check the upper right hand corner of the "invoice" and look closely, you can notice that the VISA and McAfee logos have been tampered with and just copy/pasted there.

Then the author asks the burning question: "is there an issue with this transaction?" Well of course there is, since the email came out of the blue and claimed to have withdrawn funds automatically for a subscription you didn't order, so here's where they prey on the sense of urgency by adding that "if you want your money back (who puts it like this anyway?) please contact within 12 hours, otherwise the refund will not be accepted."

This is a textbook scam and unfortunately it does make victims.. what happens if you dial that phone number? Well, the way these crooks operate is that they will try to extract sensitive personal or financial information, such as your credit card details, banking info, passwords, or account verification codes, under the guise of "resolving" the issue, in this case "issuing the refund". They will later use this information to make unauthorized transactions or gain access to your accounts. The scammers might try to coerce you into making immediate payments to cancel the supposed transaction or subscription, adding urgency and fear to pressure you into acting quickly. Furthermore, they might target you for more elaborate schemes or sell your information to other fraudsters.

So yeah, this is what usually happens in this scenario and I think it is very important to expose these scams and spread the word, to reach as many people as possible.

Flexx

https://community.bitdefender.com/en/discussion/comment/345012#Comment_345012

These scammers are terrible at design 😂

Regards

Alexandru_BD

These red flags can be spotted easily by the trained eye and if you take enough time to analyze the email content, also taking into account the context in which the email was sent.
But unfortunately many people fall prey to these scams due to the simple fact that they are in a hurry, and that this sense of urgency works many times and aims to make the recipient ignore the obvious red flags and not take the necessary time to evaluate the situation..

Flexx

Potential Scammer Tactics Using McAfee Branding:

In the image: © 2024-2025 McAfee - All Rights Reserved
Original on the McAfee website: Copyright © 2024 McAfee, LLC

Potential Scammer Tactics Using Norton Branding:

In the image: © 2024-2025 Norton LifeLock - All Rights Reserved
Original on the Norton website: © 2019–2023 NortonLifeLock Inc.

Regards

Alexandru_BD

Yeah, nice try — who on Earth pays 899 USD for a home solution.. This and "call us within 12 hours" are meant to create the feeling of urgency, of course. There are also some grammatical errors, but you can see that they made an effort to make it seem as believable as possible.

And today's lesson is: a reputable vendor will never send you an invoice out of the blue using a random gmail address!

Thanks for sharing @Flexx.

Flexx

https://community.bitdefender.com/en/discussion/comment/347226#Comment_347226

who on Earth pays 899 USD for a home solution

😂

call us within 12 hours

It's on a first-come, first-served basis; afterwards, the price will increase 😂

And one more thing I observed is that they only send me information related to McAfee and Norton subscriptions 😅

Regards

Flexx

Come onnn!!! Don’t be a scammer—there’s more to life than McAfee and Norton! Give me a discounted deal for the other antimalware vendors too. Sharing is caring! 😂

Regards

Flexx

Another one related to Norton 😂

Regards

Flexx

Now, every 24 hours, a new email 😂

Regards