Possible phishing e-mail message

[JohnBorraccl]

Earlier today (Wednesday, February 24, 2021, I found this message in my Inbox. It looks like phishing, and I wanted you to know about it.

Auto Debit Renewal Notice

Email from Billing Helpdesk: Auto Debit Renewal Notice

BH

From: 

https://connect.xfinity.com/appsuite/#

 

 

2:46 AM

 

•    

Thank you for your Auto-Renewal Order. Your Account/Card will be Auto-Debited for $299.00. 
Your subscription is now active and automatically renewed. 
for Renewal of your Computer Service/Protection Licence for 3 years. 
Your Basic Security was  included with your Internet Service has been Expired. 

If you don't wish to Renew or pay $ 299.00, Please Follow the Steps below to Cancel your subscription/for a Refund. 
Call our billing at 810-377-5777 we will gladly assist you with Canceling your service, 
If we Missed your call please Record a message with your Name and your Customer Id Number # 210315 
Our Support team will Surely call you back within 24 hours with instructions to cancel your service. 

Renewal Partners /  Norton™ LifeLock360 / Webroot® / Malwarebytes / McAfee® / Kaspersky™ 
Your order details are shown below. 

Order Details 
To find more information on your order and to manage your subscription please call us. 
Order Number: NO2141786 
3 years protection Supports - Microsoft® Windows®, Mac OS® 
Payment Mode: Direct Auto-Debit 
Amount Debit: 299.00 

Note: This is a system-generated email so replying to this email will not cancel your subscription.

Customer Service and Support 
Lifelock360 Partners Xfinity Inc |  
7601 Penn Ave | Richfield Mn | 
©2020 All Rights reserved 

To Stop Receiving our emails please Unsubscribe here

https://25112020track.way2inboxs.com/index.php/campaigns/rj262t4w640ce/track-url/yt929ggohod8f/d24549d1ae12d7e3d3909ea3dee7017eabad595a

***** end of message *****

My Malwarebytes subscription renews in early April, and it definitely NOT for $299.00 per year. Also, why would a return address be from a city near my residence?

Thanks,

John

 

Edited February 24, 2021 by AdvancedSetup
corrected font issue and removed email address

[David H. Lipman]

Thank you.

This is not a case of Phishing.  It is a variation of a Tech Support scam in the name of Norton™ LifeLock360 / Webroot® / Malwarebytes / McAfee® / Kaspersky .  Numerous forum members have posted about this type of scam.

Please Reference:

1. have received 3 scam emails about Malwarebytes account charges
2. Fake Receipt?
3. Your subscription for “Malware bytes Security” has been renewed.
4. Phishing scam using malwarebytes subscription (cares@usorderreceipt02.co)

Phishing is a process masquerading as a known entity where a web site, a PDF or other document uses content that emulates that entity and tries to get the victim to provide login credentials or Personally Identifiable Information (PII).  For example a compromised web Site may have content that looks like the legitimate Login for USAA.  However, it is all about harvesting a victims USAA account credentials.

Reference:                                     
US FBI PSA - Tech Support Fraud
US FTC Consumer Information -  Tech Support Scams
US FTC - Tech Support Operators Agree to Settle Charges by FTC and the State of Ohio
US FTC - FTC and Federal, State and International Partners Announce Major Crackdown on Tech Support Scams
Malwarebytes' Blog - Search on - "tech support scams"
Malwarebytes' Blog - "Tech support scams: help and resource page"

 

 

Edited February 24, 2021 by David H. Lipman
Edited for content, clarity, spelling and grammar

[brcd]

You can also forward the entire email  to Apple whether it is phishing or scam.  Also do likewise with your internet provider.

reportphishing@apple.com

[David H. Lipman]

No, not really.  That email address is only good if one finds a Web Site that is an Apple Phish or if if you if have a HTM or HTML email file attachment that, when rendered, becomes a Apple Phish and one discerns that it does a HTTP POST on harvested Apple related credentials.

The email was not a Apple Phish.  As I wrote this is a variation of a Tech Support scam.  It wasn't even a scam in Apple's name as this was really in the name of Norton/LifeLock and Comcast/Xfinity.  It's not a scam on Apple. and we don't want to clog a Phishing email address with something like the above.

[brcd]

David,

Thanks for clarification.

[David H. Lipman]

No problem.  If you look at my referenced examples of this kind of Renewal Tech Support scam, many reporting it have also called it "Phishing".

 

[brcd]

I will read through the examples. Thanks again.