I frequently get spam like this:

Your Payment Received for upgradation.

We upgraded your plan to pro-version.

In_Voice Number: MKZP-98540.

The details are below:

Service: Nort-One 360 Deluxe
Subscription for: 1 Year
Amount: $399.50 $198.36
Payment Source: Auto-Pay
Usage: Up to 3 Devices
Status: Activated

your plan is activated on 19 Nov 2021.

Issue with the transaction connect with our team now +1(555)555-555 [scam number redacted].



This one is pretty eggregious with all the bad grammar and spelling, but some of them look more "legit".

I don't actually own Norton, and nothing has been withdrawn from any of my bank or credit card accounts. So what's the point of this? Are they expecting me to call the phone number to find out what's going on, then they'll try to get me to divulge some information like a credit card number or SSN?

  • 17
    "This one is pretty eggregious with all the bad grammar and spelling" Heh Commented Nov 20, 2021 at 5:16
  • 34
    The spelling errors are not mistakes. It saves them time - people who notice it's got poor grammar were less likely to fall for a scam anyway.
    – corsiKa
    Commented Nov 20, 2021 at 18:20
  • 3
    By having you buy from Symantec. Commented Nov 20, 2021 at 22:36
  • If you complain, maybe they'll give you a special link to download the deluxe version of their malware?
    – Nat
    Commented Nov 21, 2021 at 15:32
  • @user3840170 FYI, I worked for Symantec for a few years about 15 years. Although not in the consumer products division....
    – Barmar
    Commented Nov 21, 2021 at 16:13

6 Answers 6


This looks like the setup for a Refund Scam.

Essentially, the target will call the number they supply all flustered about the fact that they're going to be charged some fee for a service they didn't get in the first place. In your case, $198.36. Once the target is on the phone, the scammers will likely convince the target to allow them remote access to their computer. From here, anything is possible, but the likely course of action is the following:

They will tell the target to go to their online bank account and make a note of their balance. The scammers will hide the screen from the target with their remote control software, while telling the target that they are "connecting to the secure banking server for your refund" or something similar. While the screen is hidden, they will edit the HTML of the bank's website with the target's browser's Web Development Tools to show their balance as $2000 more than it really is. This edit is purely visual, and they have done nothing to the actual value of the account. (Sometimes the scammers will also fabricate a transfer from "their bank" by transferring money between your own accounts, and then editing that transaction record as well) After this they will restore the screen to the target, with the bank minimized, then instruct the target to enter in the approximate refund amount ($200) into something like the command prompt on their own computer (which the scammers will say is their remote bank server portal). Since the scammers have access to the computer as well, they enter in an extra 0 when the target is typing, resulting in a number like $2000 being entered in. The scammers will tell the target to go to their bank again and will proceed to show that "Oh no! You've received $2000 instead of $200! Look your balance is $2000 greater than before!" Surprised, the target now believes that they owe the scammers $1800, which the scammer will gladly accept in the form of Google Play gift cards, Bitcoin, or a similar irreversible transfer method. Sometimes the scammer will give a sob story about losing their job, or be extremely hostile in order to convince the target to "return" the "stolen" $1800.

For a great example of this and many similar scams in action, I recommend a YouTube channel: Kitboga. He does scam-baiting videos and explains the process used by many of these scammers. (Plus he's pretty funny)

  • 16
    +1 for kitboga. Speedrun timer (but goal to get as HIGH as possible), scammer bingo, endless frustration for the scammers, talented voice actor, and even adds sound effects to really sell the story. Jim Browning I also find fascinating, how he uses their remote access tool to get files from their system, get webcam and security cam footage from their network, etc. He goes indepth to how the scams work on a technical level.
    – phyrfox
    Commented Nov 20, 2021 at 13:54
  • 1
    also, scammer payback Commented Nov 20, 2021 at 22:31
  • Such a complicated scheme.. I can't believe people actually fall for this
    – Tofandel
    Commented Nov 22, 2021 at 12:51
  • @Tofandel The complication is the most important part I think. The longer it goes on the more invested you are for the final outcome. A sort of sunk cost fallacy I guess. “Well I’ve already been on the phone for 30 minutes, might as well let them finish what they’re doing”. That’s what allows them to pull off such a complicated scheme. I’d imagine a quicker method of getting a payment would be too easy for the victim to reverse the transaction
    – Flats
    Commented Nov 22, 2021 at 14:35
  • 3
    They actually manage to convince people to send the money as cash, with mules picking up the packages, and it's a multi-billion dollar industry. See youtube.com/watch?v=VrKW58MS12g for the glitter bomb revenge!
    – jcaron
    Commented Nov 22, 2021 at 17:42

I have never fallen for these, or even attempted to call the number. But I am assuming it goes something like this:

The victim receives that email and says, “I didn’t order this! There has been some kind of mistake that I need to get straightened out.” So he calls the number.

The scammer on the other end, pretending to be from the company, apologizes for the problem and offers to refund the charges. He then proceeds to get as much information from the victim as possible: Credit card/bank account numbers, passwords, name, address, Social Security number, whatever they can get.

It seems to be an obvious fake email to you and me, but this email goes out to millions of people with various levels of internet savvy, and a few of those people do subscribe to Norton. An even smaller percentage of people had installed or upgraded Norton just before receiving this message, and the coincidence makes it much more believable to them.

  • 27
    One aspect of this scam is to remote connect to the victim's computer and pretend to refund an amount in excess of the original scam value, which then has to be paid again to the scammer. The former payment amount is done by mimicry, the latter is a legitimate loss to the victim.
    – fred_dot_u
    Commented Nov 19, 2021 at 21:22
  • 8
    @fred_dot_u Yes, this! This is most likely to lead to an overpayment scam. Or, possibly worse, them getting you to let them access your computer and then getting you to log into your bank account (supposedly so they can make sure you didn't already get the refund or check to ensure you received it or whatever) so they can drain it. Commented Nov 19, 2021 at 23:08
  • 2
    We're talking about attracting the most gullible people here, so depending on how much time the scammers want to put into it, they can get them to sign up for loans, take on a second mortgage, whatever, once the scammers are in touch with the victim. The sky's the limit unfortunately.
    – Nelson
    Commented Nov 21, 2021 at 14:29
  • And if the scammer is able to gain access to the person's computer, they can put on keyloggers, ransomware, or other viruses/malware to do a wide variety of other nefarious things that the person has even less control over. Commented Nov 22, 2021 at 17:19

Data Harvesting

Quite a few spam emails also contain links. Clicking on a link, at the very least, confirms that your email address is active and that you click on links. Just that bit of information by itself is very valuable to a spammer/scammer and is worth the effort of emailing you. But most likely, the link itself goes to a phishing site where you are asked to enter login credentials to confirm your account info/license/whatever. It doesn't even matter whether they know what account they go to. Once they have collected your email address and a few passwords that you use, that is also valuable info they can sell for real cash money.

Of course, many emails also contain a "tracking pixel", which is a tiny, invisible graphic that is fetched from a server when you go to read the email. This alone tells them that your email address is live, increasing its value to other scammers. This is why you should turn off all HTML in emails by default, and only load it from sources you trust.

Finally, if, for any reason at all, you call one of the numbers in the email, it is likely that they will be able to combine your email address, phone number, and name, which amplifies your victim value in scammer databases.


Clicking on a link may also trigger download of malware to your computer (and may do so in addition to the phishing site). This is why you should never click a link in an email. You should instead type the address into your browser manually, so they cannot direct you to a malicious site.

  • These emails don't have any links, just phone numbers.
    – Barmar
    Commented Nov 20, 2021 at 22:50
  • @Barmar: Seems like they might try to direct gullible victims to download malware at some point in the process if they're able. I mean, if they're unbound by moral constraints and have a ready opportunity to make some extra cash.
    – Nat
    Commented Nov 21, 2021 at 15:38
  • @Barmar I would imagine if you reply to the email then the scammer can upgrade your email address and sell it to a more sophisticated scammer. You might never know what the more sophisticated scammer has in store unless you respond to the first email. If you are really curious, I would recommend creating a separate email and only use it to respond to the first scammer. Then wait and see what other emails you get.
    – emory
    Commented Nov 22, 2021 at 16:49

Spammers and scammers acquire a massive amount of email addresses through activating a bot to scour the internet for any text following the format [email protected] or any and all comparable clients that offer email. Once a master list is established, the scammers mass send the first contact to tens or hundreds of thousands of people and await responses. They don't need everyone to respond, or even a small fraction – they only need a miniscule amount to funnel into their deception; let's call it 0.01% or 1 in 10,000. After that, they use various other predatory methods of channeling the most responsive and gullible people into their SEO, often with aggressive tactics that call for immediate action. The person being scammed has to give them access to their computer, they have to go log in to their bank accounts, they must go purchase gift cards to "pay back" the scammer for the scammer "accidentally" giving them a too large refund. Everything involves some level of urgency as soon as the scammer is in a strategic position with potential marks calling them after receiving the first email.

Only a percentage of people receiving the email will have Norton, and of those only a small amount will think that the email is legit. But even some people who don't own a Norton license will attempt to contact scammers because they honestly think that there's been an incorrect transaction; but instead of cross-referencing their bank statements or credit cards, they may go directly to the "vendor" (the fake scammer) in order to "get their money back" or find a resolution to a problem that actually doesn't exist in the first place. They're then drawn into the same playbook, one that Flats has done a good job describing in detail.

Throughout the process, they maintain meticulous running lists and document interactions in order to optimize their operation.

Ultimately, the strategy is a shotgun technique of propagating the email to as many people as possible and then proceeding to swindle the most vulnerable (internet unsavvy, disabled people, elder grandpas, etc.). They probe to find out if their targets at least have a few thousand dollars to get stolen, before they fully implement their plan, but beyond that these people have no conscience and will steal from anybody at any time if they get the opportunity. They don't care this is predating the weak and poor, because that just makes them easier to victimize. It's obvious that sophisticated intellectuals with advanced degrees are much less likely to fall for this, so those people aren't the scammers' quarry. Scammers go after the acquiescent, credulous, accommodating who don't know how computing and scams work. They've never heard of the term "social engineering" in their lives. And that's really what these frauds are doing: socially engineering those at high risk of being robbed.


maybe just to legitimise your email address.

Scammers often use scattergun approaches to target "victims" and many of the addresses they target just don't exist.

By responding to the email, you are helping them to acknowledge that the address exists which can be added to their arsenal - perhaps for other more targeted future scams.

Simple answer - Never respond to these mails, just delete them

  • scammers know that the email addresses work, but they need to determine if it's actively used by someone exploitable enough to beguile. other than that, I agree with you; it's better to never respond at all. Commented Nov 20, 2021 at 22:28
  • @FluffyFlareon how would they know the email addresses work? the only way for scammers (and others) to know an email address work is to ping it and wait for a pong back.
    – emory
    Commented Nov 22, 2021 at 16:52
  • scammers can reasonably believe they (probably) exist by extension of having harvested or web scraped, and found them as a result. not with 100% certainty, but it's extremely likely. Commented Nov 22, 2021 at 19:03

They know you didn't purchase this and are hoping you get startled and call the number asking to undo the purchase and get a refund.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .