Spammers and scammers acquire a massive amount of email addresses through activating a bot to scour the internet for any text following the format _____@gmail.com or any and all comparable clients that offer email. Once a master list is established, the scammers mass send the first contact to tens or hundreds of thousands of people and await responses. They don't need everyone to respond, or even a small fraction – they only need a miniscule amount to funnel into their deception; let's call it 0.01% or 1 in 10,000. After that, they use various other predatory methods of channeling the most responsive and gullible people into their SEO, often with aggressive tactics that call for immediate action. The person being scammed has to give them access to their computer, they have to go log in to their bank accounts, they must go purchase gift cards to "pay back" the scammer for the scammer "accidentally" giving them a too large refund. Everything involves some level of urgency as soon as the scammer is in a strategic position with potential marks calling them after receiving the first email.
Only a percentage of people receiving the email will have Norton, and of those only a small amount will think that the email is legit. But even some people who don't own a Norton license will attempt to contact scammers because they honestly think that there's been an incorrect transaction; but instead of cross-referencing their bank statements or credit cards, they may go directly to the "vendor" (the fake scammer) in order to "get their money back" or find a resolution to a problem that actually doesn't exist in the first place. They're then drawn into the same playbook, one that Flats has done a good job describing in detail.
Throughout the process, they maintain meticulous running lists and document interactions in order to optimize their operation.
Ultimately, the strategy is a shotgun technique of propagating the email to as many people as possible and then proceeding to swindle the most vulnerable (internet unsavvy, disabled people, elder grandpas, etc.). They probe to find out if their targets at least have a few thousand dollars to get stolen, before they fully implement their plan, but beyond that these people have no conscience and will steal from anybody at any time if they get the opportunity. They don't care this is predating the weak and poor, because that just makes them easier to victimize. It's obvious that sophisticated intellectuals with advanced degrees are much less likely to fall for this, so those people aren't the scammers' quarry. Scammers go after the acquiescent, credulous, accommodating who don't know how computing and scams work. They've never heard of the term "social engineering" in their lives. And that's really what these frauds are doing: socially engineering those at high risk of being robbed.
