Scam type
Tech support and fake refund scams
In a tech support scam, a pop-up or a caller says your computer is infected, or that you’re owed a refund for a service. The «support agent» gets remote access to your computer, fakes an overpayment and asks you to send back the «extra» by wire, mail or gift cards. Real companies don’t put phone numbers in pop-ups or call you about viruses.
How the call works
- A pop-up warns of a virus and shows a phone number for «Microsoft» or another brand.
- The agent asks to connect to your computer to «fix» it, and charges a few hundred dollars.
- Later they say a refund is due, fake a much larger refund on your screen and ask you to send back the difference.
- Payment goes by wire, mailed cash or gift cards.
How it often sounds
- «Your computer is infected. Let me connect and fix it.»
- «We refunded you too much by mistake. Please send back the difference.»
Typical lines described by officials and news reports.
Red flags
- A pop-up with a phone number
- A request to install an app or give remote access
- «We refunded too much»
- Mailing cash, wiring money or buying gift cards
What to do
- Close the pop-up. If it won’t close, restart the computer.
- Never let a caller control your computer.
- Check your balance yourself, by logging in to the bank directly.
Real cases
- Scam casePhantom Hacker Scam: How Victims Lost Over $6 Million in Gold BarsA pop-up, a fake Microsoft call, a fake bank and a fake government agent: how the phantom hacker scam took gold from victims aged 61 to 80.
- Scam caseTech Support Refund Scam: The Fake Overpayment Behind $42 Million in Elder FraudPop-ups sent people to fake Microsoft and McAfee support, then a fake refund “overpaid” them. How the tech support refund scam works and how to stop it.
Questions
Does Microsoft call people about viruses?
Real companies don’t call you about viruses or put phone numbers in pop-up warnings.
I gave a caller remote access. What should I do?
Disconnect the computer from the internet, call your bank on the number on your card, change passwords from another device and report it at ReportFraud.ftc.gov.