NortonLifeLock Scam

Earlier this week, a user forwarded me an email she received purporting to be a notification regarding an automatic renewal of a subscription to "Norton Life-Lock" wondering if it was legitimate and she would be charged $399 for the product.

The message included the following text:

This email confirms that your subscription has been renewed for another 1 year with Norton Life-Lock for $399.00 on April 11^th,2024.

This subscription will Auto-Renew every year unless you turn it OFF. No later than 24 hour before the end of the subscription period.

To cancel this subscription, Call: +1(844)962-1087

An online search of the 844-962-1087 number showed it is not a number associated with Norton LifeLock, a clear indication that the email was a scam where the scammer attempts to get people to call a number to cancel an expensive "subscription" for a well-known product or company. I assume those who call the number will be asked to provide their credit or debit card information, so someone pretending to be a customer service representative for the company can supposedly look up the account information to "cancel" the subscription. If credit card information is provided, the scammer can then use it for fraudulent charges or sell the information to others. Another indicator that a message such as this is fraudulent is poor English. E.g., "...unless you turn if OFF. No later than 24 hour before the end of the subscription period." Proper English would be "...unless you turn it OFF no later than 24 hours before the end of the subscription period." I.e., there should not be a period before "No later" and "hours" should be used rather than "hour." Another indication that the email is a fraud attempt in this case is that the sender hyphenated the product name, i.e., "Life-Lock" whereas if you go to the Norton website and look at their consumer products or visit the NortonLifeLock website, you can see that the name of the product is listed as "LifeLock" not "Life-Lock." The Wikipedia LifeLock page also shows the product name is not hyphenated. Such phishing emails purporting to be notifications of upcoming charges for NortonLifeLock have been prevalent for years — the NortonLifeLock website has a January 11, 2022 article " Keep an eye out for Norton email scams" warning people about such attempts and showing similar scam messages regarding their product.

Unfortunately, such scams can deceive enough people to make sending such messages profitable for scammers. People anxious to avoid a charge of several hundred dollars for a product they may not even be using may call the number and provide credit/debit card or banking information that the scammer may use to fraudulently charge their credit or debit card or steal money from a banking account.

[/security/phishing] permanent link

Phishing email leading to ridersrepublic.in

Someone notified me that she had received an email from a business contact a couple of days ago informing her that he had shared a document using Dropbox. But when she later contacted his company, she was informed that someone else was sending out email using his email address. She forwarded the message to me, which is shown below with the actual sender's address changed, though:

She was concerned that her system might have been infected by malware when she viewed the message. I scanned her system with SUPERAntiSpyware Free Edition, but SUPERAntiSpyware didn't find any malware recently placed on her system. McAfee Total Protection is the real-time antivirus software on her system, but I've found that using additional tools, such as SUPERAntiSpyware, can sometimes detect malware missed by a user's antivirus software. I performed a full scan of the system using McAfee Total Protection after running the SUPERAntiSpyware scan, but it didn't find anything, either. I also checkd the system with Malwarebytes Anti-Malware Home (Free), but it didn't find any malware, either, except for a zip file I created containing files associated with malware I found on the system quite some time ago.

[ More Info ]

[/security/phishing] permanent link