Scammed by Fake Norton Antivirus, Lifelock? Here's What to Do

Infopackets Reader Daniel B. writes:

" Dear Dennis,

I wanted to pass along this message to let your readers know of a new and incredibly convincing fake Norton email renewal scam involving Norton Antivirus and Lifelock.

I received two emails today (from two different email addresses) with a special promotion to 'upgrade' my Norton Antivirus and Lifelock with an enticing 67% discount off the retail price. The emails are incredibly convincing, unless of course you are knowledgeable enough to realize it's a scam.

If you click on a link to read more or to buy the product, it will lead you to a page where you'll give up your personal information, phone number, and/or credit card. What happens next is that an Indian tech support scammer will call you on the phone stating that there was an error with your form input on their website, then they will ask for remote access to the machine - this has already been reported on Norton's web forums, and is similar to what you described in the Expert4Help.com review.

Once they're in the machine, they'll install malware, download all your financial information (read: drain your bank accounts) and install remote access backdoors to propagate more scams. This will continue on indefinitely until you either run out of money, or wise up. "

Update 20200116: I'm getting a lot of emails from folks asking for help on this. If you let scammers into your machine, you are at risk of having your bank accounts drained and/or identity theft. If you need help ASAP, send me an email and don't forget to leave your phone number. I will call you back as soon as possible.

How to Tell if an Email 'Offer' is Actually a Scam

There is a slew of 'tells' in the emails I received that reveal this is a scam:

• First, the sender's email address is completely bogus. The only way to realize where the email is coming from is to place the mouse over top of the 'From' field to reveal the true sending address, or to view the email message headers in their entirety.
   
• Second - the phone number is fake. They ask you to call 1-833-NORTON8 (as seen in the pic here), which resolves to 1-833-667-8668. If you call the number, you'll likely be speaking with Indian tech support scammers, and they'll try to sell you years worth of 'protection,' then scam you again only a few weeks or months later when they find 'something else' wrong with your machine - similar to the tech support scams you've mentioned already.
   
• The fourth tell are the links in the email. If you hover your cursor over any of the links, your email program should show you the real web address (URL) of the link once it's clicked. In this case, it's a convoluted link which doesn't lead to Norton's website - and you can bet it's a scam.

My response:

Thanks Daniel for the heads up, and please share this post with friends! Click here to see an image of the Norton Antivirus / Lifelock scam email that Daniel received.

Scammed by Fake Norton Antivirus, Lifelock? Here's What to Do

This scam goes beyond losing money on a fraudulent license of Norton Antivirus and Lifelock - it goes much, much deeper, as I have uncovered over the years.

Please read very carefully -

1. If you paid for a fake license and installed a fake copy of Norton Antivirus, you likely installed malware on your machine.
   
   This malware can do a number of things. First, it may alert you of fake virus warnings and try to get you to call a 1-800 number to "fix" the "problem". Here is a post by Malwarebytes.com that confirms what I just said. In this case, you'll be dealing with fake tech support scammers that will convince you to allow them to connect to your machine, then they will install more malware, which will inevitably lead to draining your bank accounts. If you don't pay what they ask they'll delete all your files or lock you out of your machine as punishment, as I've reported many times before.
   
   It gets worse, however. The malware they plant on your machine can then download other malware that can record your keystrokes, spy on you, download financial information, and allow unprecedented access to your machine (remotely) by other cyber criminals.
   
   Unfortunately, uninstalling the fake antivirus won't be enough - you'll need to have your machine examined and cleaned by a real professional - such as myself - to ensure it's clean. As a senior systems administrator (view my resume here), I am able to connect to your machine and undo the damage and malware installed by these criminals. I have been providing such a service for the past 5 years and know exactly where to look - contact me here.
    
2. If you let a fake "Norton technician" connect to your machine by remote because of "problems with the online form" while attempting to purchase their fake "offer" - you are already in a heap of trouble for the same reasons I described above.
    
3. IMPORTANT: As I've reported many times previously: once scammers are connected to your machine, they can get back in whenever they want. It means they will download all your financial information from your PC, record keystrokes, and more. This translates to identity theft, unauthorized credit card charges, drained bank accounts, etc. One of my clients lost $18,000 the next day after letting scammers into his machine. This remote access must be removed and threats eliminated or you will be in a world of unending hurt. If this has happened to you already, please contact me for 1-on-1 support, and I will remove these threats for you and tell you how to keep your money safe. Contact me here.
    
4. Some scammers will go as far as trying to sell your house, as reported by the CBC (Canadian Broadcasting Corporation)! This is no joke, and originates from fake tech support scammers located in India. Please read this post for more information which also includes a 20 minute video which proves exactly what I just said.

If you called the number and need help, you are welcome to contact me for additional 1-on-1 support, described next.

Additional 1-on-1 Support: From Dennis

I've been dealing with scammers (mainly from India) for the past 5 years, and have written a number of articles concerning the subject. In short, this scam is managed by a very large criminal organization and they will do everything they can to get your money and make your life a living hell. As a senior systems administrator, I can advise you on what to do, and can also undo the damage caused by the scammers on your PC - ensuring that your computer and money is safe. If you called the number and you need help, I am more than happy to assist; simply contact me, briefly describing the issue, and I will get back to you as soon as possible.

"How do I know you're Not a Scammer, too?"

I've been publishing since 2001 and have written 6 books on MS Windows, Internet and Security. I get emails all the time about this scam; some people even ask me "How do I know you're not a scammer, too?" My response to this is that you can read my articles I've published over the last few years and also review my resume. Based on that, you should be able to understand that I am in fact legitimate, compassionate, and am more than willing to lend a hand - simply contact me, briefly describing the issue and I will get back to you as soon as possible.

About the author: Dennis Faas

Dennis Faas is the owner and operator of Infopackets.com. With over 30 years of computing experience, Dennis' areas of expertise are a broad range and include PC hardware, Microsoft Windows, Linux, network administration, and virtualization. Dennis holds a Bachelors degree in Computer Science (1999) and has authored 6 books on the topics of MS Windows and PC Security. If you like the advice you received on this page, please up-vote / Like this page and share it with friends. For technical support inquiries, Dennis can be reached via Live chat online this site using the Zopim Chat service (currently located at the bottom left of the screen); optionally, you can contact Dennis through the website contact form.