From: [email protected]
Subject: Invoice from Norton LifeLock (#INV-48213)
Your annual subscription of $499.99 has been renewed. If you did not authorise this transaction, call our support line at +1 (805) xxx-xxxx within 24 hours to cancel and receive a refund.
Here's what makes this one nasty: the email is genuinely from PayPal. The sender is real, the links go to paypal.com, and it shows up in your PayPal activity. Scammers use PayPal's own invoicing and "request money" tools to send you a demand, and PayPal delivers it for them.
Short answer: it's a scam, but not a phishing email. Nobody has charged you anything. The invoice is a request, not a payment. The goal is to make you call the number in the note.
What happens if you call
You reach a "refund department". They'll say the charge can be reversed if you install a "secure refund tool" (remote-access software like AnyDesk) or log in to your bank while they watch. Then they "accidentally refund too much" and ask you to send the difference back - by gift card, wire or crypto. Everything after the phone call is the classic refund scam.
How to tell
- You didn't buy anything. An invoice for something you never ordered is a request for money, not a receipt.
- A phone number in the note. PayPal never puts support numbers inside invoices, and Norton, McAfee, Geek Squad and Amazon don't bill through random PayPal accounts.
- The seller name is a big brand, the account isn't. Open PayPal yourself and look at the request: the "merchant" is an ordinary account created last week.
What to do
- Don't call, don't reply, don't pay. Nothing has been taken from you.
- Log in to paypal.com (type it yourself) → Activity → find the request → Cancel it. You can also report the sender from there.
- Forward the email to [email protected] - PayPal shuts these accounts down.
- If you already installed remote software: turn the computer off, then uninstall it and change your bank and email passwords from another device. Call your bank if you logged into it while they were connected.
Not sure? Paste it
Scamed spots the "big brand + phone number + call within 24 hours" pattern and explains why the source being real doesn't make the message safe.