Yes it's a scam. They want you to call the number so they can perform a refund scam.
Is this a scam
I received an email today that says:
[Moderator's note: PII removed]
Microsoft TeamsMicrosoft Teams### A Microsoft customer, *** has added you to a team. Team name------------------------Team name### Payment auto-renewal is an agreement where a service automatically continues to charge your card at the end of a billing period Amount 489. 99 USD Speak with Support at 1 (805) 331-8539 Plan: Norton Ultimate Plus (1 Year) Invoice ID: ***
Is this a scam? Thank you.
Microsoft Teams | Microsoft Teams for business | Teams and channels | Other
-
BryceSor 4,600 Reputation points Volunteer Moderator
2025-12-02T23:48:49.0266667+00:00 Hi Randy Wheeler,
Its a scam so delete it if possible, also report it to https://support.microsoft.com/en-us/topic/avoid-and-report-microsoft-technical-support-scams-392515fa-c630-b41d-2039-a637d5eaaec2
Here's a check list for the future if people use the email scam, a few things to look for.
🛡️ Scam Email Response Checklist
1. Initial Scan
Look for mixed branding (e.g., Microsoft + Norton in the same message).
Check for poor formatting or odd phrasing.
Watch for large, urgent charges designed to scare you.
2. Verify Sender
Check the From address carefully — scammers often use look‑alike domains.
Hover over links to see if they lead to non‑Microsoft or non‑Norton sites.
3. Red Flags
Phone numbers in emails: Microsoft and Norton do not ask you to call random numbers.
Unexpected invoices: If you don’t use the product, the bill is fake.
Generic greetings: “Dear customer” instead of your actual name.
4. Safe Actions
Do not call the number or reply to the email.
Do not click links or download attachments.
Report the email as phishing in your mail client.
5. Double‑Check Accounts
- If concerned, log in directly to your Microsoft account or Norton account via their official websites. (It could be other companies as well)
Confirm there are no charges or subscriptions listed.
6. Report & Educate
- Forward the email to your provider’s phishing report address (e.g., reportphishing@) if they have one.
- Share this checklist with others to help them avoid similar scams.