20231018_TECH_SUPPORT_SCAM_1

Tech Support SCAM Phone Number: (805) 206-2717

Provider: Bandwidth.com

E-Mail Address: [email protected]

E-Mail Subject: YOUR_NAME_HERE, Transaction for order no XXXXXXX

Pretends to be vendor: LifeLock

Hustle description: Sends an e-mail pretending to be an automatic renewal for LifeLock Premium Services.  Requests you call the SCAM call center where they will then attempt to bill you for services on your credit card.

E-Mail Content:


Date : Thursday, 19 October 2023
Transaction No : 987198362
Customer Support : 805 206 2717

YOUR_FIRST_NAME_HERE, Renewal Invoice for you
We'd like to take this opportunity to thank you for your support over the past 1 Year. We value all contributions to LifeLock, and memberships make up the lifeblood of our organization. Your involvement is extremely important to us and very much appreciated.

This is a friendly reminder that your subscription with us will renew on Thursday, 19 October 2023. We hope you have been enjoying your membership with LifeLock! Thank you for the membership. Our approach to business starts with you. You are scheduled for a bill to be paid automatically from your bank account, or charged to your visa, MasterCard.

The following are the details of your Recurring Billing.
Payment Id- 7940-359-5729
Charge Frequency: 1 Year
Customer: YOUR_FULL_NAME_HERE
Amount: $314.85

In case you don't want to continue with us then make sure you call us on 805 206 2717 before Thursday, 19 October 2023 to avoid any recurring payment. We hope that you'll take this time to renew your membership and remain a part of our community.

Copyright © LifeLock, All rights reserved.





Received: from CH3PR05MB9507.namprd05.prod.outlook.com (2603:10b6:610:14c::5)
 by MWHPR0501MB3899.namprd05.prod.outlook.com with HTTPS; Wed, 18 Oct 2023
 17:56:29 +0000
Received: from BYAPR07CA0037.namprd07.prod.outlook.com (2603:10b6:a03:60::14)
 by CH3PR05MB9507.namprd05.prod.outlook.com (2603:10b6:610:14c::5) with
 Microsoft SMTP Server (version=TLS1_2,
 cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6907.21; Wed, 18 Oct
 2023 17:56:25 +0000
Received: from MW2NAM12FT074.eop-nam12.prod.protection.outlook.com
 (2603:10b6:a03:60:cafe::3d) by BYAPR07CA0037.outlook.office365.com
 (2603:10b6:a03:60::14) with Microsoft SMTP Server (version=TLS1_2,
 cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6907.21 via Frontend
 Transport; Wed, 18 Oct 2023 17:56:25 +0000
Authentication-Results: spf=pass (sender IP is 209.85.214.170)
 smtp.mailfrom=gmail.com; dkim=pass (signature was verified)
 header.d=gmail.com;dmarc=pass action=none header.from=gmail.com;compauth=pass
 reason=100
Received-SPF: Pass (protection.outlook.com: domain of gmail.com designates
 209.85.214.170 as permitted sender) receiver=protection.outlook.com;
 client-ip=209.85.214.170; helo=mail-pl1-f170.google.com; pr=C
Received: from mail-pl1-f170.google.com (209.85.214.170) by
 MW2NAM12FT074.mail.protection.outlook.com (10.13.180.212) with Microsoft SMTP
 Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.6907.15 via
 Frontend Transport; Wed, 18 Oct 2023 17:56:25 +0000
Received: by mail-pl1-f170.google.com with SMTP id d9443c01a7336-1caa7597af9so6940535ad.1
        for <>; Wed, 18 Oct 2023 10:56:25 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=20230601; t=1697651783; x=1698256583; darn=;
        h=to:from:subject:mime-version:date:message-id:from:to:cc:subject
         :date:message-id:reply-to;
        bh=wFbdcOxNm/dS3G6qNXioW/s/hYjw5BiD8pvQhr5aLLY=;
        b=WG8klKsVnFCv0xM2PZ7fimoWthcsMRHJqEZ+bOUVCKzot4B8e9MA6RD7dsf6sr3s8o
         e2NMOcLa8FZbUB70h/93eHRXmJJp5VpvVc1gFmYLfQwXOU4sW+nsl0hY+cr4AD/MYbCI
         At2iO2uS/9/WmRYxTLMoZzdaCUtIH5Sespo3S+YEl5eK++D4LsyndlqfX/Jc1Yeqqorx
         HWGuvsccOEqGOJMRnBuf/O+Mlw+Cy3PTGcaAbjpZ9ypKjcg/8e91XQ6kYRi77BO9Y6Be
         dsNAvz4Jluskk1e77LZxJDwt9sUikZSwf7ApnZPwnr7LNx9WuJne/OF5EmHte/eR7imJ
         HkjA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=1e100.net; s=20230601; t=1697651783; x=1698256583;
        h=to:from:subject:mime-version:date:message-id:x-gm-message-state
         :from:to:cc:subject:date:message-id:reply-to;
        bh=wFbdcOxNm/dS3G6qNXioW/s/hYjw5BiD8pvQhr5aLLY=;
        b=QTJ70THbAo5JT7F01W2xAxpo8kswasKC7ZutPT8KgsWY7fA3CiFQSOJoqIGDlY11pM
         SX9td+FS79yB9lHg/dXjG+J7AhDyoN64wtjxPzxiQ7jpyR/8QqJMXX35Ba2g6Jk8l0cS
         17AFVbSuVNzf9l2BBp6xCE4yseF2LrOiRsjFsrAiVpBYHvVFWTz8IysIft3mTVkYtJXs
         +xzMNpWTgXzqUZ5w6MeNJUq9K54GUTp66hbzYaGmICVwgHMbfQ/MFgMhpHQGSvqTq2oT
         Zowc3pBjQaSOx31YO7dk86L+ZzCscqSzWjqmEYAoPPL8XaVVeGkB1WAMh22RmAIUYJfa
         UHdQ==
X-Gm-Message-State: AOJu0YyNMUtE8001Uj3AIFl8MN3D3ZscLXgZA4Hi1C+J7MapROuwZonA
	/z0lDZcFEkEgLs/WWdG0zFngNG9EM9Iw3g==
X-Google-Smtp-Source: AGHT+IGAl5b35LPEsFtGm/Ilugkt9zNqjj4/M2OGJpUJsG2u6n/j5WnM8lIV7r4hnDr9jnZrju1n3Q==
X-Received: by 2002:a17:903:24d:b0:1ca:1c89:9adb with SMTP id j13-20020a170903024d00b001ca1c899adbmr76642plh.51.1697651783429;
        Wed, 18 Oct 2023 10:56:23 -0700 (PDT)
Return-Path: [email protected]
Received: from [172.26.0.93] ([43.153.49.44])
        by smtp.gmail.com with ESMTPSA id e6-20020a170902d38600b001c9d2360b2asm221923pld.22.2023.10.18.10.56.22
        for <>
        (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
        Wed, 18 Oct 2023 10:56:23 -0700 (PDT)
Message-ID: <[email protected]>
Date: Wed, 18 Oct 2023 10:56:23 -0700 (PDT)
MIME-Version: 1.0
Subject: YOUR_FIRST_NAME_HERE, Transaction for order no 8877GFD
From: "YOUR_NAME_HERE" <[email protected]>
To: YOUR_EMAIL_ADDRESS_HERE
X-MS-Exchange-Organization-ExpirationStartTime: 18 Oct 2023 17:56:25.1048
 (UTC)
X-MS-Exchange-Organization-ExpirationStartTimeReason: OriginalSubmit
X-MS-Exchange-Organization-ExpirationInterval: 1:00:00:00.0000000
X-MS-Exchange-Organization-ExpirationIntervalReason: OriginalSubmit
X-MS-Exchange-Organization-Network-Message-Id:
 7c71f8eb-f49c-47cb-6acc-08dbd0038bbe
X-EOPAttributedMessage: 0
X-EOPTenantAttributedMessage: 0d4bfd0a-5b8b-4c86-b245-3f11f8ea539a:0
X-MS-Exchange-Organization-MessageDirectionality: Incoming
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic:
 MW2NAM12FT074:EE_|CH3PR05MB9507:EE_|MWHPR0501MB3899:EE_
X-MS-Exchange-Organization-AuthSource:
 MW2NAM12FT074.eop-nam12.prod.protection.outlook.com
X-MS-Exchange-Organization-AuthAs: Anonymous
X-MS-Office365-Filtering-Correlation-Id: 7c71f8eb-f49c-47cb-6acc-08dbd0038bbe
X-MS-Exchange-Organization-SCL: 5
X-Forefront-Antispam-Report:
 CIP:209.85.214.170;CTRY:US;LANG:en;SCL:5;SRV:;IPV:NLI;SFV:SPM;H:mail-pl1-f170.google.com;PTR:mail-pl1-f170.google.com;CAT:SPM;SFS:(13230031)(62800002)(84530400002)(84050400002)(230922051799003)(451199024)(19627405001)(22186003)(5660300002)(8676002)(1096003)(76482006)(121216002)(6916009)(73392003)(9686003)(58800400005)(33964004)(336012)(82202003)(956004)(26005)(426003)(83380400001)(7636003)(7596003)(356005)(55446002)(40140700001)(86362001)(43540500003);DIR:INB;
X-Microsoft-Antispam: BCL:0;
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 18 Oct 2023 17:56:25.0736
 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 7c71f8eb-f49c-47cb-6acc-08dbd0038bbe
X-MS-Exchange-CrossTenant-Id: 0d4bfd0a-5b8b-4c86-b245-3f11f8ea539a
X-MS-Exchange-CrossTenant-AuthSource:
 MW2NAM12FT074.eop-nam12.prod.protection.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH3PR05MB9507
X-MS-Exchange-Transport-EndToEndLatency: 00:00:04.1287238
X-MS-Exchange-Processed-By-BccFoldering: 15.20.6886.034
X-Microsoft-Antispam-Mailbox-Delivery:
	ucf:0;jmr:0;auth:0;dest:J;OFR:SpamFilterAuthJ;ENG:(910001)(944506478)(944626604)(920097)(930097)(3100021)(140003);RF:JunkEmail;
X-Microsoft-Antispam-Message-Info:

Content-type: multipart/alternative;
	boundary="B_3780483101_957519772"

> This message is in MIME format. Since your mail reader does not understand
this format, some or all of this message may not be legible.

--B_3780483101_957519772
Content-type: text/plain;
	charset="UTF-8"
Content-transfer-encoding: quoted-printable