About This Email

A reader in our group shared an email they received claiming they had purchased Norton Pack, that it had already auto-renewed, and that they would be charged $215 within 24-48 hours. It said that if they wanted to cancel, they needed to call a phone number right away. It even included details like an invoice number, so it looked fairly convincing.

Of course, when I saw the words “auto renew,” my first reaction as a blogger who occasionally gets burned while deal hunting was that this reader may have forgotten to cancel during a deal and ended up getting charged for another year of Norton Pack. There really have been Norton subscription deals in the past that came out ahead.

What Looked Off at First Glance

Of course, as someone familiar with a lot of common scam tactics, I immediately noticed something suspicious.

  • This phone number was formatted very strangely. It was stretched out, with a lot of extra spaces in the middle. It didn’t match the style of the rest of the text and stood out too much.
  • Normally, phone numbers in legitimate emails are formatted naturally within the text, like in this email from US Bank below.

So the first thing I did was search the phone number. If it were really a Norton-related customer service number, you would usually be able to find it online pretty quickly. But the number shown in the email led nowhere useful.

That’s why I suggest readers first check the sender’s email address. Scam emails often use a display name like “xx customer service,” while the actual email address is a mess. And many email apps only show the sender’s chosen display name at first.

The Truth

Once I looked at the sender information, it became obvious. The email was actually sent to a gmail address starting with norton, with the reader merely copied on it. Meanwhile, the sender was a gmail address named walkerhalnjjk. That is clearly fake. So this was 100% a scam email.

When you click into a legitimate sender, the domain is usually normal. Sure, email domains can also be spoofed or tampered with, but in the vast majority of cases, I can tell right away just by looking at the sender’s email domain. After all, simple scams are often enough to filter for people who are easier to fool.

As for why this is a scam email, my guess is that it gives you a phone number and mentions a refund because once you call, they will probably ask for your credit card number, expiration date, and CVV under the pretense of issuing a refund. Then they can misuse your credit card—maybe immediately, or maybe later after you’ve forgotten about the whole thing.

Summary of the Red Flags

Of course, besides the sender and the phone number, there are other warning signs too. Once you know what to look for, scam emails become much easier to spot.

Sender

As mentioned above, if the email was not directly sent to you, or if the sender’s email domain looks strange, it is usually not a good sign. Legitimate businesses generally use email addresses under their own website domain. If they are using a generic email service like gmail or some random free email provider, that is often a bad sign.

Phone Number

I mentioned this above, but it is also worth explaining why scam email phone numbers are often formatted so oddly. Email providers usually have filtering systems that automatically catch common scam emails. If an email contains a phone number, the server may extract it and compare it with known scam numbers. If it matches, the email may get sent straight to spam.

To avoid detection, this email wrote the phone number with extra characters mixed between the digits—possibly full-width dashes—or with spaces inserted throughout. A person can still read and dial it normally, but a machine may not recognize it as a phone number, which helps it avoid being flagged automatically as spam. So when I saw that oddly formatted number, my first reaction was that something was wrong.

Greeting

Companies usually include your personal information in the greeting automatically. Generic greetings are often just used to make mass sending easier.

For example, this one was also very likely a mass spam email.

Simple Grammar or Capitalization Errors

These scam emails often contain strange spelling, grammar, or capitalization mistakes. One possibility is that the sender is not a native English speaker, so the email includes common language errors. Another possibility is that the mistakes are intentional, helping them filter for people whose English is weaker and who may be more likely to fall for it.

Messy Formatting

Scam emails are generally sent in bulk, so individual messages are usually not polished carefully. That means the formatting may be sloppy. In this example, parts are misaligned, and even the ellipses do not line up with the text. Overall, it just looks rough.

Where You Can Practice Spotting Them

If you want to sharpen your eye, open your gmail inbox and check the spam folder. You will probably see all kinds of scam emails that were automatically filtered there.

Bottom Line

Scam emails are very common. The key is to pay attention to the details and not trust them too quickly. Be especially careful whenever an email involves your financial information or personal information. It is also a good idea to search suspicious phone numbers on Google—if a number is shady, there are often plenty of people asking about it or filing report fraud complaints. We also wrote a separate guide on scam emails if you want to learn more.