The PayPal Norton $407.14 invoice scam is the kind of email that can make you stop what you are doing for a second. It tells you that a Norton antivirus subscription has supposedly been renewed for $407.14 and that the money will be taken from your account. Then comes the part designed to make you react quickly: if you don’t want the charge, you are told to call a customer service number to cancel the renewal or request a refund.
The amount is high enough to make the message feel urgent, especially if you use PayPal or have ever had a Norton subscription. The email may also look like a legitimate PayPal payment notification, which makes the whole thing more convincing. But there is no $407.14 Norton renewal waiting to be cancelled. This is a PayPal invoice scam and phishing attempt designed to get the recipient to call a fake support number and hand over information, money, or access to their computer.
I found a recent example of the scam showing a message claiming that $407.14 had been billed for Norton and that the recipient needed to call a phone number to cancel the supposed auto-renewal. The message even included an order number, which gives it the appearance of a normal subscription receipt. The reported campaign uses the PayPal invoicing system to make the message look more credible, rather than simply sending an obviously fake PayPal screenshot.
What is the PayPal Norton $407.14 invoice scam?
The scam starts with an email claiming that your Norton subscription has automatically renewed for $407.14. The wording can make it sound as though the payment has already been processed or is about to be deducted from your bank account. You are then given a phone number to call if you want to dispute or cancel the charge.
That phone number is the real trap.
The scammers want you to see the large Norton charge, become concerned that your money is about to disappear, and call before you have time to check your actual PayPal account. Once you call, the person on the other end can pretend to be PayPal or Norton support. From there, the conversation can move into requests for personal information, banking details, payment information or remote access to your computer.
PayPal specifically warns about this type of invoice fraud. Its own guidance says scammers can send invoices or money requests for products or services that the recipient never ordered, then add an alarming note telling the recipient to call a fake customer-service number. PayPal says not to pay these invoices, call numbers included in the invoice, or open suspicious links.
Why does the $407.14 Norton email look so believable?
What makes this scam more interesting than an ordinary fake email is the way the payment request is presented. A message appearing inside the PayPal ecosystem can feel much more trustworthy than an email that merely has a PayPal logo pasted into it.
That does not mean the invoice itself is legitimate.
Scammers can abuse legitimate payment and invoicing features to send fraudulent requests. In the Norton version of the scam, the recipient is given a familiar brand name, a specific dollar amount, an apparent subscription renewal and a reason to call immediately. It creates a believable story without the victim actually having purchased anything.
The Norton name is useful bait because antivirus subscriptions are normally paid products, and people may not immediately remember when their security software renews or which card is attached to an old subscription. A $407.14 charge is also large enough to create the fear that something has gone seriously wrong with the account.
That is exactly the reaction the scammer wants.
The fake Norton renewal is not the real problem
It is tempting to focus on whether Norton really costs $407.14, but that is not really the point of the scam. Even if you have never used Norton, the message is written to make you believe that someone has access to your PayPal account and has charged you for an expensive antivirus subscription.
The scammers don’t necessarily need you to believe every detail. They only need you to believe the charge might be real.
Once you call the number in the message, they have a much better opportunity to manipulate you. They can tell you that they need to verify your account, confirm your payment information, process a refund or help remove the supposed subscription. A fake technician may eventually ask you to install remote-access software such as AnyDesk or TeamViewer, allowing them to see or control your computer.
At that point, the original $407.14 invoice is almost beside the point. The phone call is where the fraud can become much more serious.
Is the $407.14 Norton charge actually in PayPal?
This is one of the easiest ways to check what is happening, and it is also where people sometimes make the mistake of trusting the email instead of their account.
Don’t use the phone number in the message to find out.
Open PayPal yourself by typing the website address into your browser or using the official app. Sign in and check your Activity and any invoices or payment requests. If there is no genuine $407.14 Norton transaction in your account, there is nothing in the email that needs to be paid or cancelled over the phone.
PayPal specifically advises users who receive an unfamiliar invoice or money request to log into their PayPal account directly and check it there. Its instructions also allow suspicious invoices to be cancelled or reported from the account.
This is much safer than clicking the email or calling the number provided by the person who sent it.
What should you do with a fake PayPal Norton invoice?
If you receive the PayPal Norton $407.14 invoice email, don’t pay the invoice and don’t call the number displayed in the message. If you have a PayPal account, log in separately and check your activity to see whether an actual transaction exists.
If the invoice appears inside your PayPal account, PayPal provides an option to report an unwanted invoice or money request. On the website, you can open the invoice from Activity, select Report this invoice or Report, and follow the instructions. PayPal also says suspicious invoices can be cancelled from the account.
You can also forward suspicious PayPal emails to [email protected] and then delete them. PayPal gives this address specifically for reporting suspected phishing messages.
If you have already called the number, the next steps depend on what happened during the conversation. If you gave away banking or card information, contact your financial institution using its official number and explain what happened. If you gave someone remote access to your computer, disconnect the device from the internet and take steps to remove the remote-access software and check the computer for anything that may have been installed.
How to recognize the PayPal Norton invoice scam
The biggest clue is the combination of an unexpected Norton renewal, a large $407.14 charge and an instruction to call a phone number to cancel or dispute it. That combination should immediately make you stop and verify the supposed transaction through PayPal itself.
PayPal also advises users to be careful with messages that create a false sense of urgency, contain suspicious links or direct them to websites that are not actually PayPal. The company says users should check the true destination of links before clicking and should access their PayPal account directly when they need to verify an account issue.
There is another useful point here: a legitimate-looking PayPal email does not automatically make the underlying invoice legitimate. The scammer’s message may be generated through a genuine PayPal function, which is why simply looking at the branding is not enough. What matters is whether you actually authorized the transaction and whether the payment request corresponds to something you purchased.
Conclusion
The PayPal Norton $407.14 invoice is a scam when it arrives as the unsolicited Norton renewal message described above. The $407.14 charge is being used as bait to get people worried enough to call a fake customer-service number. The goal is not really to help you cancel Norton; it is to get you talking to the fraudster, where they can attempt to obtain sensitive information, payments or access to your computer.
What I particularly don’t like about this scam is that it uses a very ordinary situation to create the panic. People receive subscription-renewal emails all the time, and Norton is a familiar name. Put those two things together with a PayPal-looking invoice and a large but believable amount, and it becomes easy to understand why somebody might reach for the phone before checking their account.
If you receive an email saying “$407.14 billed for Norton”, don’t call the number in the message and don’t assume your PayPal account has actually been charged. Go directly to PayPal, check your transaction history, and report the invoice if it is fraudulent. PayPal itself confirms that unsolicited invoices and payment requests are a common type of scam and specifically warns users not to call phone numbers included in suspicious invoice notes.
Check out Mansculpt wave therapy plus that I talked about earlier.