“Norton Subscription Payment Has Failed” Scam – A Deceptive Phishing Threat

The “Norton Subscription Payment Has Failed” scam is a fraudulent scheme designed to trick users into believing that their Norton AntiVirus subscription has expired and that they need to update their payment information. This scam is not affiliated with Norton or its parent company, Gen Digital Inc., in any way. It exploits users’ fears about losing cybersecurity protection to either steal personal data, commit financial fraud, or distribute potentially unwanted applications (PUAs) and malware.

This scam typically appears as a pop-up or a webpage notification, falsely warning that the user’s antivirus subscription has expired. The page urges them to renew their subscription with a 50% discount, luring them into entering their financial details. Some versions of this scam redirect users to the official Norton website, likely abusing affiliate programs to generate commissions. However, there is no guarantee that such redirects will always be safe. Victims could also be led to phishing sites or malware-infected pages.

---

Threat Summary

Attribute	Details
Name	“Norton Subscription Payment Has Failed” pop-up scam
Threat Type	Phishing, Scam, Social Engineering, Fraud
Fake Claim	User’s Norton AntiVirus subscription payment has failed, urging renewal.
Disguise	Norton AntiVirus
Detection Names	CRDF (Malicious), ESET (Malware), Seclookup (Malicious), CyRadar (Suspicious), Forcepoint ThreatSeeker (Suspicious)
Serving IP Address	45.141.156.249
Symptoms of Infection	Fake error messages, fraudulent pop-ups, misleading system warnings, scam computer scan results.
Damage	Loss of sensitive information, monetary loss, identity theft, potential malware infections.
Distribution Methods	Compromised websites, rogue pop-up ads, potentially unwanted applications (PUAs).
Danger Level	High – May result in financial fraud, identity theft, and malware infections.

---

How Does the Scam Work?

This fraudulent scheme follows a well-orchestrated process that preys on user fears regarding cybersecurity protection. Here’s how the scam unfolds:

1. Fake Expiry Notification
   The victim encounters a pop-up or webpage with a fraudulent message stating that their Norton subscription payment has failed and that protection has expired.
2. Urgent Call to Action
   The scam claims that immediate action is required to restore security. It might even show a specific expiration date (e.g., “Your Norton AntiVirus expired on January 28”) to add urgency.
3. Discount Offer to Lure Victims
   To persuade victims, the scam offers a 50% discount on renewal, making the deal appear legitimate and enticing.
4. Phishing or Malware Infection
   Clicking the "Restore Protection" button may result in:
   • Redirection to a phishing site where victims enter personal and financial information.
   • Installation of malicious software, such as browser hijackers, adware, or other PUAs.
   • Potential affiliate fraud, where scammers gain commission for tricking users into subscribing via their links.

---

Fake Scam Message Text

Victims typically see a message similar to the following:

Norton subscription payment has failed!

Attention: Your antivirus subscription of Norton AntiVirus has expired on January 28.
Please update your payment details to restore protection immediately.

As a returning customer, you are eligible for a discount: 50% OFF

[Restore Protection]

Unprotected PCs are 93% more vulnerable to suffer from malware.

Windows | macOS | Android | iOS

This text is crafted to instill urgency and fear, pressuring users into taking immediate action.

---

How to Remove the "Norton Subscription Payment Has Failed" Scam

If you have encountered this scam, follow these steps to remove potential malware infections and secure your system.

Step 1: Close the Scam Page

• If you see the pop-up, do not click on any links.
• Close the browser tab or press Ctrl + Shift + Esc to open the Task Manager and forcibly close your browser.

Step 2: Uninstall Suspicious Programs

• Windows:
  1. Press Win + R, type appwiz.cpl, and hit Enter.
  2. Locate any unknown or suspicious programs, right-click, and select Uninstall.
• Mac:
  1. Open Finder > Applications.
  2. Drag any suspicious applications to the Trash and empty it.

Step 3: Remove Malicious Browser Extensions

• Google Chrome: chrome://extensions/
• Mozilla Firefox: about:addons
• Microsoft Edge: edge://extensions/
• Safari: Preferences > Extensions

Disable and remove any extensions you don’t recognize.

Step 4: Scan Your System with SpyHunter

To ensure complete removal, use SpyHunter, a powerful anti-malware tool that detects and eliminates hidden threats.

1. Download SpyHunter.
2. Install and run a full system scan.
3. Remove any detected malware, PUAs, or tracking cookies.

Step 5: Reset Browser Settings

Resetting your browser can remove unwanted settings changed by adware or browser hijackers.

• Chrome: chrome://settings/reset
• Firefox: about:support → Click "Refresh Firefox"
• Edge: edge://settings/reset
• Safari: Preferences > Privacy > Manage Website Data > Remove All

---

How to Prevent Falling for Similar Scams

To avoid phishing scams like "Norton Subscription Payment Has Failed", follow these cybersecurity practices:

1. Never Click on Suspicious Pop-Ups: If an alert about your subscription or security software appears unexpectedly, verify the claim by going directly to the official Norton website.
2. Enable Pop-Up Blockers: Use browser extensions like uBlock Origin or AdBlock to prevent deceptive ads.
3. Use Two-Factor Authentication (2FA): This adds an extra layer of protection against unauthorized access.
4. Avoid Downloading Cracked Software: Unofficial or pirated software often contains adware, PUAs, and malware.
5. Keep Your Software and Security Tools Updated: Regular updates help patch vulnerabilities that scammers might exploit.
6. Verify Emails and Notifications: Scammers may spoof legitimate emails. Always double-check senders and links before taking action.
7. Scan Your Device Regularly: Run periodic anti-malware scans to detect and remove threats early.

---

Conclusion

The "Norton Subscription Payment Has Failed" scam is a dangerous phishing tactic used to deceive users into revealing financial information or installing malware. Although some versions redirect to the official Norton website, there is no guarantee that future scams will do the same. Users should remain vigilant, avoid interacting with suspicious pop-ups, and use trusted security tools like SpyHunter to protect their devices.