There is a Norton email scam going around that is easy to mistake for a real billing problem, especially if you use PayPal. The message claims that Norton LifeLock Benefit Solutions has charged, or is about to charge, your account $310.50 for Norton 360 with LifeLock Ultimate Plus and identity theft protection. It may arrive with a PDF invoice attached, mention PayPal as the payment method and even display your own email address in the message. At first glance, it looks like the kind of email that would make you stop what you are doing and check your account immediately.
That reaction is exactly what the people behind these emails are looking for.
The $310.50 Norton PayPal invoice is not a genuine Norton renewal notice simply because it contains the Norton name, a realistic-looking invoice or information that appears to be connected to your email account. Norton has warned about this particular style of fake renewal email, explaining that scammers send messages claiming a Norton subscription is renewing for a large amount and provide a telephone number for the recipient to call to cancel the supposed charge.
The important part of the scam is what happens when you make that call.
What is the Norton PayPal invoice scam?
This is essentially a fake billing and tech-support scam built around a Norton renewal. Instead of stealing your information directly through a normal phishing link, the email tries to convince you that somebody has already charged your PayPal account.
The amount is deliberately large enough to get your attention. In the version I am looking at, that figure is $310.50, supposedly for Norton 360 with LifeLock Ultimate Plus and identity theft protection.
That product name is not completely made up, which is one reason the email can look convincing. Norton really does sell Norton 360 with LifeLock Ultimate Plus, and the genuine plan includes device security and identity-theft protection.
But that does not mean the invoice sitting in your inbox is genuine. A scammer can take the name of a real product, put it on a fake invoice and then add a phone number that has nothing to do with Norton.
That is what makes this particular scam more dangerous than an obviously ridiculous email. The ingredients are real; the transaction is not.
The fake $310.50 Norton 360 charge
The email claims that Norton 360 with LifeLock Ultimate Plus has been purchased or renewed for $310.50. The wording can make it sound as though the money is already on its way out of your PayPal account.
If you do not remember purchasing Norton, that creates an immediate problem in your mind. You may think someone has accessed your PayPal account, stolen your card details or somehow renewed a Norton subscription without your permission.
Then the email gives you a solution: call the number in the attached invoice.
That is the trap.
Norton describes this type of message as an auto-renewal scam, where a fake renewal notice creates urgency and pushes the recipient toward a telephone number controlled by the scammer. Norton says that callers may then be asked for personal information, credit-card or bank details, or PayPal information under the pretense of cancelling or refunding the charge.
The PDF invoice is part of the trick
I think the PDF attachment is one of the details that makes this scam particularly believable.
People are accustomed to receiving invoices as PDFs, so seeing an attachment with a Norton logo, an invoice number, a subscription description and a customer-service telephone number can make the message look more official than a plain email would.
But a PDF is just a document. It does not prove that Norton generated it.
The same goes for your email address appearing inside the invoice. If the message shows the exact address you use for PayPal, that does not establish that PayPal or Norton sent it. Your email address can already be known to scammers through previous data exposure, marketing databases, old accounts or other sources.
The scammer wants that small piece of genuine information to make the rest of the story feel genuine.
The fake 888 and 812 phone numbers
The telephone numbers are where I would be especially careful.
The version of this Norton PayPal scam I looked at gives recipients numbers including an 888 number and an 812 number described as a “DirectLine Priority Desk.” The wording is designed to make the number sound like an official Norton billing department that can immediately cancel the supposed charge.
It isn’t.
Calling one of those numbers does not connect you with official Norton customer support merely because the person answering claims to work for Norton or PayPal. Norton specifically warns that scammers impersonate reputable companies and use phone numbers inside fake renewal notices to get consumers to contact them.
PayPal gives almost exactly the same warning from its side. The company says scammers can create invoices or money requests containing alarmist notes that tell recipients to call a fake customer-service number, with the goal of obtaining personal or financial information. PayPal’s advice is to log into your account directly rather than calling the number in the invoice.
That is a pretty good description of what is happening here.
Why would scammers pretend to be Norton?
Because Norton is a name people recognize.
If an unknown company emailed you saying, “You have been charged $310.50 for a security subscription,” you might delete it. Put Norton, PayPal and LifeLock into the same message and suddenly the email looks much more serious.
The scammer is borrowing trust from three familiar names: Norton, PayPal and LifeLock.
The message does not actually need to prove that a transaction happened. It only needs to make you worried enough to call.
Once you are on the phone, the person can introduce themselves as a Norton billing representative, PayPal support agent or some kind of cancellation department. They may tell you that they can see the transaction and need information from you before they can reverse it.
That is when the scam can move from a fake invoice into a much more serious attempt to steal money or personal information.
What happens if you call the number?
There are several ways this type of scam can develop, and Norton has documented them.
A caller may ask for your card number or PayPal login details because they supposedly need them to process a refund. They may ask you to install remote-access software so they can “help” cancel the subscription. They may claim that your computer has been compromised and that additional security work is required.
Norton specifically warns about unofficial support providers impersonating the company and says that legitimate Norton product support is provided through its official support channels.
PayPal also warns that fake invoice scams can lead to requests for personal or financial information over the telephone.
The scary part is that you might actually call them voluntarily. From the scammer’s perspective, that is much easier than trying to convince you to answer a random cold call.
You are already concerned about the supposed $310.50 charge when the conversation begins.
Is $310.50 the real Norton price?
This is another detail that can make the email confusing because genuine Norton 360 with LifeLock Ultimate Plus does exist.
Current Norton pricing for the genuine product varies depending on the plan, billing period and promotional offer. Norton’s current product page lists Norton 360 with LifeLock Ultimate Plus at a promotional first-year price below $310.50, with a higher renewal price displayed separately.
That does not prove that every $310.50 invoice is fake based on the amount alone. The problem is that the email is not an independently verified Norton account statement. A scammer can choose an amount that sounds believable.
If you actually have a Norton subscription, the correct way to check its status is to sign into your Norton account independently or contact Norton through its official support website. Norton provides account and renewal support through its official Help Center.
In other words, don’t let the amount on the PDF determine whether you believe the email. Check the account itself.
What if I don’t even have Norton?
Then the email becomes much easier to identify as suspicious, although you should still avoid interacting with it.
A person who has never purchased Norton 360 with LifeLock Ultimate Plus obviously has no reason to believe they suddenly owe $310.50 for it. But even people who have never used Norton can get caught because the email is written as though the purchase has already happened and the recipient needs to act quickly to stop it.
That urgency is deliberate.
Norton itself says scammers use fake renewal notices with unusually high charges and phone numbers to create pressure on recipients.
You do not have to solve the problem by calling the person who sent you the message.
What if the email mentions my PayPal address?
Seeing your PayPal email address in the message can make it feel much more personal, but it still doesn’t prove anything.
The scammers may simply be using an address that is already associated with you. They may also include PayPal branding because they know that a supposed PayPal payment makes the fake Norton renewal sound more believable.
The safest way to check is incredibly simple: open PayPal yourself, either through the official app or by entering the PayPal website into your browser, and look at your activity.
Do not click the link in the suspicious email to get there.
PayPal specifically tells consumers to log into their account directly to verify whether an invoice or payment request is legitimate, and says not to call phone numbers contained in suspicious invoices.
If there is no $310.50 transaction in your PayPal account, that is much more useful information than anything written on the PDF.
What PayPal says about fake invoices
PayPal’s own scam guidance is remarkably relevant to this situation. The company warns that fraudsters can send invoices or money requests that look legitimate and include an alarming message telling the recipient to call a fake customer-service number.
PayPal says these scams are intended to trick people into sending money or revealing personal and financial information. It advises consumers not to pay unfamiliar invoices, not to call phone numbers included in the invoice and not to open suspicious links.
PayPal also says suspicious invoices can be reported through the PayPal website or app. If you receive a suspicious email, PayPal asks users to forward it to [email protected] and then delete it.
That is a much safer route than calling the “DirectLine Priority Desk” number printed on a document sent by an unknown person.
What Norton says about these emails
Norton has its own page explaining how scammers impersonate the company through fake renewal and payment emails. The examples are surprisingly close to what is being circulated now: a high-dollar Norton renewal, an attached invoice and a telephone number supposedly provided to cancel the transaction.
Norton also advises consumers to be suspicious of urgent renewal notices, fake transaction details and phone numbers supplied inside unexpected messages. Suspicious Norton emails can be forwarded as attachments to [email protected].
So if you receive the $310.50 Norton PayPal invoice, you do not need to call the number printed on it to find out whether it is real. Norton has already described this type of scam and provides a reporting channel for suspicious messages.
The biggest mistake would be trying to get a refund from the scammer
This is where people can get themselves into trouble.
The email tells you that a charge has been made, so naturally you want to reverse it. The scammer is counting on that instinct. Once you call, they can tell you that they need your PayPal information to issue the refund, or that they need to connect to your computer to remove the subscription.
Now the fake $310.50 charge has become an excuse to obtain information that can be used to steal real money.
You should never give an unsolicited caller your PayPal password, one-time verification code, full card number or banking credentials. PayPal says not to provide sensitive account information through suspicious communications and recommends contacting the company through its official channels instead.
If you genuinely see an unauthorized transaction in PayPal, deal with it from inside your PayPal account rather than through the telephone number supplied by the email.
Is the Norton PayPal invoice scam real?
Yes. The Norton PayPal invoice scam is a real type of phishing and impersonation scam, and the specific $310.50-style renewal email fits the pattern that Norton and PayPal have both warned consumers about. Norton has documented fake renewal emails that use high charges, attached invoices and telephone numbers to lure people into contacting scammers, while PayPal has warned about fake invoices containing alarmist messages and fraudulent customer-service numbers.
The fact that the email uses the real Norton 360 with LifeLock Ultimate Plus product name does not change that. The fact that it mentions PayPal does not make it a PayPal transaction. Even seeing your own email address in the message does not prove that the sender has access to your account.
What matters is what you find when you independently check your accounts.
What should you do if you receive the $310.50 Norton email?
I would not reply to it, call the 888 or 812 number, click through its links or use the attached PDF to find a way of contacting the supposed billing department. Instead, open PayPal independently and check your activity. If you have a Norton account, sign into it separately and check your subscriptions there as well.
If the supposed charge does not appear in PayPal, there is no reason to let the invoice convince you that money has been taken from your account. You can report a suspicious PayPal email to [email protected] and forward suspicious Norton emails to [email protected], then delete the message.
If you already called the number and gave the caller financial information, contacted them through a remote-access session or allowed them to control your computer, the situation is more serious and you should act quickly to secure your accounts and contact your bank or payment provider.
Conclusion
The fake Norton invoice works because it looks like a billing problem that needs immediate attention. A $310.50 charge for Norton 360 with LifeLock Ultimate Plus sounds believable enough, the PDF gives the message an official appearance, PayPal makes the supposed payment feel familiar and the phone number gives you an apparently simple way to make the problem disappear.
Norton has warned about fake renewal emails using exactly this general approach, and PayPal separately warns that scammers use fake invoices and alarming notes to get people to call fraudulent customer-service numbers.
If you receive one, don’t try to settle the matter with whoever sent it. Check your PayPal account directly, check your Norton account directly if you have one, and use contact information obtained from the official websites rather than the PDF.
The invoice may say Norton LifeLock Benefit Solutions, Norton 360 with LifeLock Ultimate Plus, $310.50, PayPal, or even display your own email address. None of those details prove that the charge is real. The only thing that matters is whether the transaction actually exists in your account and whether you are dealing with Norton or PayPal through a contact method you obtained independently.
Check out Mansculpt wave therapy plus that I talked about earlier.