They are to do so while their screens are darkened, and the scammers then change the supposedly transferred amount to be larger.

Typically, the end goal is to trick victims into thinking that they are about to have their money refunded, but they are asked to type the amount themselves.

Alternatively, scammers can achieve this by moving money within the accounts (e.g., from checking to savings). However, changing the HTML does not affect the actual funds in the bank account, but when victims look at theirs - they see a different sum. Hence, the bank account's page is edited while scammers use the remote access software features to darken the users' screens. Cyber criminals can manipulate what is seen by editing website HTML. Once access is established, in refund scams - victims are asked to log into their online bank accounts.

Both require the scammers to remotely access victims' devices, which they do by presenting themselves as 'support' or 'expert technicians' and guiding users by phone. It is most likely an amalgamation of a refund and tech support scams. What scam model this spam campaign follows is unclear. Therefore, the recipient has not subscribed to or purchased anything - hence, no amount of money will be charged. The spam letter contains a telephone number, which is to be used if the recipient wishes to cancel the subscription to 'Norton LifeLock', and prevent the sum from being charged.Īs mentioned in the introduction, this email is fake.

The aim is to trick recipients into calling the provided number to cancel the bogus payment/subscription.Įssentially, this fake 'Norton LifeLock' email is presented as an invoice, informing the recipient of a successful purchase and payment. This scam letter is presented as a purchase invoice, which states that the payment has already been processed. It must be emphasized that this spam mail is in no way associated with either NortonLifeLock Inc. After inspecting this 'Norton LifeLock' email, we determined that it is fake.

Norton life lock number