Scammers impersonate NordVPN employees

What is going on?

Criminals are contacting online creators, like YouTubers and streamers, pretending to represent major brands. Once the scammers have convinced their victims that they really work for the company, they offer to arrange some form of promotional integration.

The scammers’ goal is to trick creators into installing malware on their device. To do this, they tell their victims to download a file, claiming that it is a contract or some piece of essential promotional material. In reality, this is a piece of malicious software that can hijack the creator’s device and accounts.

Identify the scammers

We value the online creator community and our relationship with them, and the last thing we want is for them or their fans to be scammed. Here are a few ways to spot these malicious emails:

• Check the sender’s email address. Make sure the email you have received comes from an official NordVPN domain (@nordvpn.com or @nordvpnmedia.com) or an official Nord Security domain (@nordsec.com). If the email is from any other address, do not trust it. You should also look out for unusual spelling and characters, like @n0rdvpn.com or @nord-security.biz. If you have any doubts about the legitimacy of an email address, take further steps to verify its authenticity, as explained later in this article.
• Look for spelling and grammar errors. Official messages from NordVPN will not contain mistakes of this kind. If you notice any errors or unusual and messy formatting, be on your guard.
• Be wary of urgent messages. If the sender seems to be trying to create a sense of urgency, telling you to agree to their demands and take action quickly, it may be an attempt to hustle you into downloading malware. Hackers are often worried that if you take time to think about it, you will realize what they are up to. Genuine NordVPN representatives will always approach you in a professional manner and will never pressure you into following links or handing over information.

This scam is not the only threat you should be on your guard against, of course. You may wish to read up on other NordVPN scam signs.

Next steps

If you think you have been contacted by a scammer or you just have some lingering doubts, play it safe and double-check the sender’s authenticity.

You can do this by contacting NordVPN’s customer support team through live chat or by emailing support@nordvpn.com. If someone within NordVPN has already contacted you, we will let you know whether or not the email you’ve received is genuine.

If you’re certain that the email is fake, please contact NordVPN via the aforementioned channels and let us know. Our teams are doing everything possible to stop scams like these, and you can help us by bringing these emails to our attention. You should also report the sender to your email service provider because doing so can prevent them from further contacting you or scamming other people.

You can find more information on the steps you can take in this situation on our support page.