I almost did a double take when I saw this one because the email is designed to look like something you would actually worry about. The message claims that Norton LifeLock Benefit Solutions has charged, or is about to charge, your PayPal account $310.50 for Norton 360 with LifeLock Ultimate Plus and identity theft protection. There may be an invoice attached to the email, your own email address may appear in the message, and PayPal is mentioned as the payment method. If you happen to have a PayPal account and you see an unexpected charge for more than $300, it is very easy to think someone has gotten hold of your account and that you need to sort it out immediately.
That is exactly what the scammers are counting on. The Norton PayPal invoice scam is not really about selling you Norton 360. The fake invoice is being used to frighten you into contacting the people behind the email. Once you call the phone number printed on the invoice, the person answering can claim to be Norton, PayPal or a billing department and start asking questions about your account, card, bank information or computer. PayPal itself warns that invoice scams can use alarmist messages and fake customer-service numbers to persuade people to hand over personal or financial information.
What the Fake Norton Invoice Says
The version I came across claims that Norton 360 with LifeLock Ultimate Plus has been purchased for $310.50 and that PayPal is being used to process the payment. The wording is meant to make the transaction sound like something that has already been authorized, rather than a random marketing email. It may even contain your email address, which can make the whole thing feel much more personal.
That part is worth remembering because seeing your email address does not prove that the message came from Norton or PayPal. Your email address can be obtained from old data breaches, mailing lists, leaked databases, public sources or previous scams. Scammers do not need access to your PayPal account to know the email address associated with it.
The attachment is another part of the setup. Instead of simply saying that you have a problem, the email gives you something that looks like an official invoice or billing document. That makes the message feel more substantial, and when there is a large dollar amount sitting on the page, most people are going to want an explanation.
The Phone Number Is Where the Scam Really Starts
This is the part I would pay the most attention to. The fake invoice provides telephone numbers, including numbers presented as a “DirectLine Priority Desk,” and encourages the recipient to call if the charge is not recognized. The whole point is to get you off the email and onto the phone with the scammer.
Once you call, you are no longer dealing with the real Norton or PayPal customer-service team. The person on the other end can simply tell you that they need to verify your account or cancel the transaction. From there, the conversation can move toward requests for your card number, bank details, PayPal login information, verification codes or other personal information.
Norton has specifically warned about fake emails that impersonate the company, including messages containing fake invoices and phone numbers that victims are told to call about an alleged renewal or charge. Norton says scammers may ask for payment or personal information after the victim contacts the number provided in the message.
PayPal describes essentially the same trick in its own scam guidance. It warns that fraudulent invoices and payment requests may contain an alarmist note telling you to call a fake customer-service number, with the aim of getting you to reveal personal or financial information.
Is the $310.50 Norton Charge Real?
If you receive one of these emails and you have no idea why Norton would be charging you $310.50, do not use the invoice to investigate the charge. That is where people can get themselves into trouble.
Open PayPal separately by typing the official website into your browser or using the PayPal app you normally use. Sign in and look at your actual activity and payment history. If there is no $310.50 transaction there, the email is not evidence that someone has charged your PayPal account.
This is much safer than clicking a link in the email or calling the telephone number printed on the attached invoice. PayPal specifically recommends logging into your account directly to check whether an invoice or payment request is legitimate.
The same applies to Norton. If you really have a Norton subscription, sign into your account through the official Norton website and check your subscription and billing information there. Norton advises consumers to verify unexpected charges through their Norton account or official support channels rather than using contact information supplied by a suspicious message.
Why Does the Email Mention Both Norton and PayPal?
This is actually what makes the scam more believable. Instead of impersonating just one company, the message borrows credibility from two names that most people recognize.
You see Norton, so you think antivirus subscription. You see PayPal, so you think payment. Then you see a specific amount, an invoice number and a telephone number, and suddenly the email looks like a genuine billing problem that needs to be fixed.
The combination is clever because it gives the victim a ready-made explanation for why they should call. You are not being asked to call a random number out of nowhere. You are supposedly calling to cancel a charge that has already been placed on your account.
That is why these scams can work even on people who would normally recognize an obvious phishing email. The message is built around a problem that you are encouraged to solve immediately.
The Email Address Does Not Make It Legit
Another thing that caught my attention is the way these emails can display the recipient’s actual email address. If you see your own address inside an invoice, it can give the impression that the sender must have access to your PayPal account.
That conclusion does not follow.
PayPal warns consumers about fake messages and says that suspicious emails can contain fake invoices and attachments. Its guidance also recommends checking the actual sender information and avoiding unknown attachments rather than assuming an email is legitimate because it contains personal-looking information.
So if the email says something like “Dear [your email address]” or displays your address next to the supposed PayPal payment, I would not treat that as proof of anything. It is just another piece of information the scammer can use to make the message look convincing.
What Happens If You Call the Number?
This is where I would be especially careful. A scammer who has already convinced you that a $310.50 payment is about to leave your account has a very easy opening for the next part of the conversation.
They can tell you they need to cancel the order. They might ask you to confirm your name and email address. Then they can move on to your PayPal details, card information or a security code. In some versions of Norton impersonation scams, the caller may also try to convince the victim to install remote-access software so they can supposedly “process the cancellation” or issue a refund.
Norton has documented tech-support scams in which criminals impersonate legitimate technology companies and attempt to obtain personal information or gain access to a victim’s computer. Norton also describes fake subscription and invoice scams where the victim is encouraged to contact a number supplied by the scammer.
That is why I would never call the number on this invoice, even if the person answering sounds professional and knows the name of the product supposedly being purchased. Anyone can read the same fake invoice you received.
What If You Opened the PDF?
If you opened the attachment but did not enter any information, do not immediately assume that your PayPal account has been compromised. The safest next step is to close the document, avoid clicking anything else inside the message and delete the email.
If the attachment asked you to click a link, download software or enter your PayPal credentials, the situation is more serious. In that case, I would go directly to PayPal rather than using anything contained in the email, change your password if you entered it into a suspicious site, review recent account activity and enable appropriate security protections.
If you gave someone your card or bank details over the phone, contact the financial institution that issued the account as soon as possible. The sooner a suspicious transaction is reported, the more options you may have for protecting the account.
How to Report the Norton PayPal Invoice Scam
If you receive this fake Norton invoice, PayPal says suspicious emails can be forwarded to [email protected] and then deleted. It also recommends reporting unwarranted invoices or payment requests through your PayPal account.
Norton similarly asks consumers to forward suspicious Norton-related emails as attachments to [email protected].
If you actually lost money or provided financial information to the scammer, contact your bank or credit-card company and explain what happened. For internet-related fraud in the United States, you can also submit a report to the FBI’s Internet Crime Complaint Center (IC3).
Conclusion
The thing I dislike most about this scam is that the fake invoice does not need to convince you that you bought Norton. It only needs to make you worried enough to pick up the phone.
That $310.50 amount is there to get your attention. The Norton branding is there to make the charge look familiar. The PayPal reference makes the supposed payment sound believable, and the telephone number gives you an easy way to “fix” the problem. Once you call, however, you are giving the scammer exactly what they wanted: a direct conversation with someone who is already concerned about losing money.
So if you receive a Norton PayPal invoice, do not call the number printed on the PDF and do not reply to the email. Check your PayPal account directly and check your Norton account separately. If there is no corresponding transaction, that tells you far more than anything written on the suspicious invoice.
PayPal’s own advice is simple: do not pay an invoice you do not recognize, do not call numbers included in suspicious invoice messages and verify your account through the official PayPal website or app.
In other words, the $310.50 charge in the email is not something you need to panic about. The real danger is being persuaded to call the fake “support” number and handing the person on the other end the information they need to turn a fake invoice into a real financial loss.
Check out Mansculpt wave therapy plus that I talked about earlier.