A common modern con pairs fake tech support with a fake refund. The caller (or pop-up “agent”) claims Microsoft, Apple, Amazon, Norton, or your bank overcharged you. They demand remote access through AnyDesk, TeamViewer, or Quick Assist, flash a fake credit on screen, then insist you “send back the extra” with gift cards, wire, crypto, or Zelle. Real Apple, Microsoft, and bank support do not cold-call to collect Google Play or Steam codes.
Broader tech-support patterns: Tech support and refund scams. Phishing and takeover: How to spot phishing and account takeover. Spoofed bank texts: Fake bank security alerts.
How the refund script works
| Stage | What you hear / see | What they want |
|---|---|---|
| Hook | Pop-up, search-ad “support,” or spoofed caller ID | Fear: virus, locked account, “IRS/SSA computer case” |
| Access | “Install AnyDesk so we can refund you” | Full remote control of the PC |
| Fake credit | Screen-share shows a temporary deposit or “pending refund” | Trust that money moved |
| Extraction | “We sent $799 by mistake—buy cards / wire / Zelle it back” | Irreversible payment |
| Silence | Hang up once PINs or codes are read | Funds gone; sometimes malware left behind |
The “deposit” may be edited HTML, a stolen account view, or a real push that later reverses—leaving you short either way.
Worked example: the $649 “Microsoft overpayment”
Morgan Googles “Microsoft support” after a full-screen warning and calls a paid search ad. The voice guides Morgan into Quick Assist, “finds” malware, and says Microsoft owes a $649 goodwill refund. A bank window appears to show +$649. The agent then says payroll over-refunded and Morgan must buy $649 in Apple Gift Cards and read the numbers to “clear the ledger.”
Morgan hangs up, force-quits the browser, and disconnects Wi-Fi. No cards bought. If PINs had been read aloud, those balances would be spent in minutes. Gift-card payment risk: Gift cards and prepaid debit risks. “Send it back” over Zelle: Zelle and P2P payment scams.
Red flags that end the call
- Unsolicited pop-up or call demanding remote access.
- Payment in gift cards, crypto, wire, or P2P to “complete a refund.”
- Pressure to stay on the line while you drive to a drugstore.
- Caller refuses to let you hang up and dial the number on the back of your card or on apple.com / microsoft.com.
- They ask for one-time passcodes from SMS or authenticator apps.
General scam taxonomy: Credit and debt scams. Spoofed support numbers: Fake customer support phone numbers.
First hour if you already shared access or paid
- Disconnect the PC from the internet; uninstall unknown remote tools.
- From a different device, change bank, email, and Apple/Google passwords; enable MFA.
- Call banks and card issuers using numbers on the card or official site—report unauthorized transfers.
- If gift-card PINs were shared, contact the card issuer’s fraud line immediately (recovery is limited).
- Place freezes or fraud alerts at Equifax, Experian, and TransUnion if identity data was exposed (Credit freezes and fraud alerts).
- Report to ReportFraud.ftc.gov and your local police if money moved; file with IC3.gov for internet crime.
Account takeover after a breach playbook: How to avoid account takeover after a data breach.
Checklist
- Never grant remote access from a cold call or browser lock screen.
- Never “return a refund” with gift cards, crypto, wire, or P2P.
- Hang up; reboot; use official support URLs typed by you.
- Treat search-ad phone numbers as untrusted until verified.
- If access was granted, assume credentials are burned—reset from a clean device.
- Document dates, caller ID, amounts, and screenshots for bank and FTC reports.
Fake Discord Nitro gift links and malware “unlockers” that steal tokens: Fake Discord Nitro scams.
Social-app “verification fee” refunds that demand a second gift-card payment: Fake Instagram verified-badge scams.
TikTok Shop “refund desk” chats that push AnyDesk or gift-card processing fees: Fake TikTok Shop refund scams.
iCloud storage-full phishing that escalates into gift-card “upgrade” or remote-access refund scripts: Fake iCloud storage-full scams.
YouTube copyright-strike “appeal desk” chats that push AnyDesk or gift-card reinstatement fees: Fake YouTube copyright-strike scams.
Fake Apple Support iMessage and Activation Lock fear scripts that push gift cards or remote access: Fake Apple Support iMessage scams.
Fake Amazon refund and customer-service phone scams that push gift cards or remote access: Fake Amazon refund scams.
Fake Meta Business Suite / Ads Manager past-due billing and remote-access “support”: Fake Facebook Ads Manager scams.
Educational only. Not legal, fraud-recovery, or cybersecurity advice. Scam scripts change; verify contacts on official sites and follow your bank’s fraud instructions.