The checker reads one suspicious email. Batmail reads your whole inbox overnight.
Paste the Norton email into the checker and it reads it for the signs below.
The checker reads the sender address, the wording, any link address you paste with the email and what the email asks you to do. It gives a verdict, a risk score from 0 to 100, the exact wording behind each red flag and what to do next. It is free and needs no signup.
Batmail phishing email checker
A fake Norton renewal says a big charge went through and gives a number to cancel it.
Norton’s page on cyber scams describes an email that looks like it is from a reputable company and contains a Norton renewal notice, an attached invoice and a phone number to call to cancel a pending credit card charge. The email below is invented, and each number is one of the signs.
Example
Hello customer,
Thank you. Your antivirus subscription renewed for 3 years. Total charged: $449.99. Invoice 0000000 is attached.
Did not request this renewal? Call our cancellation desk now on 1-800-555-0166 to stop the charge.
Charges are final after 24 hours.
The button says norton.com/my-account
The sender's address is not at a Norton domain.
The name says Norton, but the part after the @ belongs to someone else. Norton publishes a list of its real domains, covered in the next section.
A renewal you never asked for, with an invoice attached.
Norton describes a fake email with a Norton renewal notice, an attached invoice and a phone number to call.
A phone number to call to stop the charge.
Norton says the phone number is there to cancel a pending credit card charge. The FTC says: “Do not use the number included in the message.”
A deadline and a threat.
Norton says these messages try to create a sense of urgency by threatening to charge your credit card unless you respond.
A button that says norton.com and goes somewhere else.
Google says that if a link's address does not match its description, it might lead to a phishing site.
From Norton Support: Cyber scams and how to avoid them, read 7 November 2026.
From FTC Consumer Advice: How To Spot, Avoid, and Report Tech Support Scams, read 7 November 2026.
From Gmail Help: Avoid & report phishing emails, read 7 November 2026.
Norton publishes a list of its real domains, so you can look the sender up.
Anyone can put “Norton” in front of an address. The part to read is the domain, after the @. Read it from the right: the last two parts name the owner, and everything in front of them is only a label the owner chose. Norton’s page lists its legitimate domains, such as @norton.com and @email.norton.com. It says to press Ctrl+F or Command+F in your browser, type the part after the @ from your email, and see whether it is listed. If the domain is listed, the email is a legitimate Norton email.
Read the domain from the right
email.norton.com
On Norton's listOwned by norton.com. Norton lists email.norton.com as a legitimate domain.
norton.com.account-review.example
Not on Norton's listOwned by account-review.example. norton.com is only a label in front of it.
norton-secure-billing.example
Not on Norton's listOwned by norton-secure-billing.example. The name has Norton in it, but the owner is someone else.
From Norton Support: Verify that an email you receive from Norton is legitimate, read 7 November 2026.
Norton says an unexpected charge is checked in your Norton account, not by a number in a message.
Norton’s advice is the same for every kind of fake billing message: verify any unexpected charge or order you haven’t made directly through your Norton account or official Norton support channels. The table below turns its page into four questions.
| Question | What Norton says | What a fake Norton message does |
|---|---|---|
| Is the sender's domain on Norton's list? | What Norton saysNorton publishes a list of legitimate domains. If the domain is listed, the email is a legitimate Norton email. | What a fake Norton message doesIt uses a look-alike domain with Norton in the name. |
| Does it ask you to call to cancel a charge? | What Norton saysNorton describes a fake email with a renewal notice, an attached invoice and a phone number to call to cancel a pending credit card charge. | What a fake Norton message doesIt says the charge posts soon and gives only a phone number. |
| Is it a calendar invite about billing? | What Norton saysNorton says it never sends calendar invites related to billing or payment. | What a fake Norton message doesAn event saying your subscription is expiring or a payment is pending. |
| How do you check a charge? | What Norton saysNorton says to verify it through your Norton account or official Norton support channels, and not to call phone numbers listed in a suspicious notification. | What a fake Norton message doesIt tells you to use its own number or link. |
From Norton Support: Cyber scams and how to avoid them, read 7 November 2026.
From Norton Support: Verify that an email you receive from Norton is legitimate, read 7 November 2026.
The fake renewal reaches you by email, by calendar invite and through shopping apps.
Norton’s page lists more than the email. The same push to call a number shows up in places people trust more than their inbox.
Where the fake renewal arrives
- An email
A renewal notice, an attached invoice and a number to call.
Norton says to forward it as an attachment to spam@norton.com.
- A calendar invite
An event that says your subscription is expiring or a payment is pending.
Norton says it never sends calendar invites related to billing or payment.
- A shopping app notice
A fake order for a Norton product, with a fake support number.
Norton says these messages are not sent by Norton, and not to call the number in the notification.
From Norton Support: Cyber scams and how to avoid them, read 7 November 2026.
The FTC says the same renewal scam borrows McAfee's name, and the advice does not change.
The FTC’s page on tech support scams says scammers use the names of well-known companies like Geek Squad, McAfee and Norton. The message says you were charged hundreds of dollars, and that you must call a phone number within 24 hours to dispute it. The FTC’s advice for any of them is to contact the company using a phone number you know is real, and not the number in the message. For a real McAfee email, check it on McAfee’s own site, and paste the one you are unsure of into the checker above.
From FTC Consumer Advice: How To Spot, Avoid, and Report Tech Support Scams, read 7 November 2026.
Five steps tell you whether a Norton email is real without clicking anything.
- Leave the button, the attachment and every link alone, and do not call the number. Norton says never to click on any links in suspicious emails.
- Look up the sender’s domain on Norton’s list of legitimate domains. If it is not there, do not trust the email.
- Check the charge where Norton says to: your Norton account or official Norton support channels. Your bank or card statement shows whether anything was really charged.
- Paste the email into the checker at the top of this page for a second read.
- Forward the email as an attachment to
spam@norton.com, then delete it. For a fake calendar invite, Norton says to forward the invite as an attachment and delete the event. In Gmail you can also choose More next to Reply, then Report phishing.
From Norton Support: Cyber scams and how to avoid them, read 7 November 2026.
From Norton Support: Verify that an email you receive from Norton is legitimate, read 7 November 2026.
If you called or paid, Norton lists what to change and who to contact.
Norton’s steps if you were scammed are to change your passwords, run a Full Scan, and contact the company that charged you. If that does not settle it, Norton says to contact your bank to report the problem. The FTC’s page for people who were scammed adds a step for each way you may have paid.
What to do depends on what you did
You only read it.
Forward it to spam@norton.com as an attachment and delete it.
You clicked, opened the attachment or called.
Change your passwords for your computer, financial institutions, Norton account and other password-protected sites, and run a Full Scan for viruses.
You paid or shared card or bank details.
Contact the company that charged you, then your bank. Follow the FTC’s steps for what to do if you were scammed and the steps at IdentityTheft.gov.
From Norton Support: Cyber scams and how to avoid them, read 7 November 2026.
From FTC Consumer Advice: What To Do if You Were Scammed, read 7 November 2026.
From FTC Consumer Advice: How To Recognize and Avoid Phishing Scams, read 7 November 2026.
The same checks work on other renewal and invoice emails.
A renewal with a number to call is a pattern. The guide to fake Geek Squad invoice emails covers the same message under another name, and the guide to fake Microsoft sign-in emails covers an account alert. The holiday scam emails guide puts the kinds side by side.
These are the questions people ask next.
How do I know a Norton email is really from Norton?
Norton publishes a list of legitimate Norton domains and says to search the page in your browser for the part after the @. If the domain is listed, the email is a legitimate Norton email, and @norton.com is on the list. Norton also says to never give personal or confidential information to a sender or web page you do not know or trust.
What does a fake Norton renewal email look like?
Norton describes an email that looks like it is from a reputable company and contains a Norton renewal notice, an attached invoice and a phone number to call to cancel a pending credit card charge. It says these emails often threaten to charge your credit card unless you respond, or warn of expired antivirus settings or an infection on your computer.
Does the same scam use McAfee's name?
Yes. The FTC says scammers use the names of well-known companies like Geek Squad, McAfee and Norton. The message says you were charged hundreds of dollars to renew a tech support subscription and that you must call a phone number within 24 hours to dispute it. The FTC says to contact the company directly using a phone number you know is real.
Does Norton send calendar invites or shopping app notices about billing?
Norton says it never sends calendar invites related to billing or payment. It says fake order notices in shopping apps are not sent by Norton, and to verify any unexpected charge through your Norton account or official Norton support channels, without calling the phone numbers in the notice.
Where do I report a fake Norton email?
Norton says to forward suspicious emails as an attachment to spam@norton.com. For a fake calendar invite, forward the invite as an attachment and delete the event. In Gmail you can also open the message, choose More next to Reply, then Report phishing.
What do I do if I called the number or paid?
Norton says to change your passwords for your computer, financial institutions, Norton account and other password-protected sites, run a full scan for viruses, and contact the company that charged you. If that does not fix it, Norton says to contact your bank to report the problem. The FTC says to report an unauthorized charge to your card issuer or bank and ask them to reverse it.
Every step on this page comes from these official pages.
Read on . Spot a step that has changed? Email support@batmail.ai and we will fix it.
- Norton Support: Cyber scams and how to avoid them
- Norton Support: Verify that an email you receive from Norton is legitimate
- FTC Consumer Advice: How To Spot, Avoid, and Report Tech Support Scams
- FTC Consumer Advice: What To Do if You Were Scammed
- FTC Consumer Advice: How To Recognize and Avoid Phishing Scams
- IdentityTheft.gov
- Gmail Help: Avoid & report phishing emails