Norton/PayPal/Xero Renewal Scam

TL;DR

• Target receives an email from Xero where the email is actually from Xero!

• The invoice is for a Norton 360 "renewal"

• There is an option to "View Invoice" which takes you to a genuine Xero invoice on the Xero website

• Viewing the invoice gives you no direct ability to pay

• Viewing the PDF version also gives you no ability to pay and this is where things start to look dodgy

• Choosing the Save to Xero option will add the invoice to your accounts payable if you are using Xero

• There is still no option to pay so you have to call the number included in the email

• Calling the 1800 number puts you in contact with the scammer

• The scammer will invite you to give them access to your computer without telling you they will have access to your computer

• Nek minnit, they have stolen money from your bank account

The email is clever

• The email is actually from Xero which lends itself to the credibility of the email

• The scammer has signed up with Xero to perpetrate this scam

• The sender email address is exactly what it looks like when we send out an invoice from Xero

• from Paypal_Invoice is not so clever of course

• The email was received late yesterday, ie June 30 with a due date of June 30 so there is a sense of urgency

• There is a statement that the amount has already been deducted from your bank account which increases the sense of urgency

• The price seems a tad excessive which generates a There's no way I am paying that! type of thought process

• They have a customer care department although it's clear if that is Norton. PayPal or Xero!

• The sign-off is just plain dumb of course Paypal_Invoice is not in the slightest bit convincing

• So, there are obvious weaknesses but overall is one of gthe better scam emails we have seen

So you call the number included with the email

• You have to do this if you want to pay the account because there is no other way to pay

• You have to do this to request a refund or to cancel the invoice

• So you call the number

• The scammer answered my call and their name/company was indistinct, mainly because it sounded like he was calling from a chicken coop

• He asked me what he could do to help me and I explained that I had received the email invoice

• He asked my whether I wanted to continue with the internet security or cancel

• This is clever because I am choosing, he has not barrelled me into anything, it's a perfectly reasonable question

• I said I did not wish to renew the service

• He then asked me if I was at my computer to which I answered "yes"

So, what happens next?

• I don't know for this phone call because I then used some very rude words to express my view about what he was attempting to do

• To his credit, he gave as good as he got and I had to hang up on the scammer for a change!

• Keeping in mind the notion of a refund plus a cancellation number the next step is insidious

What the scammer would have liked me to do!

• You are asked to log into your bank account

• Because you are not aware they are remotely accessing your computer, it seems like a reasonable suggestion

• You will then check your bank account for the payment which they will insert without you even noticing

• They will then process a Refund where again they will insert a page which is an edited version of you internet banking page

• The page you see will show that they accidentally refunded you (say) $5000 instead of $500

• They will apologise profusely and ask you to transfer it back

• Note that the amount of overpayment will be closely matched to the balance of your bank account which they can see!

• You can see they overpaid you so you transfer the balance back to their nominated bank account

• OSKO will then make sure the scammer steals your money in the blink of an eye

• It's like OSKO and Anydesk are in on these scams, they certainly do nothing to prevent them!

Contact us at Lincoln Computer Centre for more information regarding defending yourself from scams, or recovering from a scam