Tech support scams and fake refund scams trick you into believing Microsoft, Apple, Amazon, your bank, or “Windows Security” needs remote access, or that you were overcharged and must “verify” a refund. The goal is remote control of your PC, bank credentials, gift-card PINs, wire, or crypto. Real Apple, Microsoft, and bank support do not cold-call to demand payment in Google Play, Apple Gift Card, or Steam codes.
Broader patterns: Credit and debt scams. Phishing playbook: How to spot phishing and account takeover.
Common scripts
| Script | How it starts | What they want |
|---|---|---|
| Fake virus pop-up | Full-screen “call Microsoft / Apple now” | Remote access + card/gift cards |
| Spoofed support call | Caller ID looks like 1-800 support | AnyDesk/TeamViewer + “refund” overpayment |
| Fake refund | “We overcharged $399; help us reverse it” | You send back the “extra” via Zelle, wire, or crypto |
| Search-ad fake support | You Googled “Apple support” and called a paid ad | Same remote-access funnel |
| ISP / “Amazon account locked” | Urgent text with a link | Passwords, one-time codes, payment method update |
Refund variants often run a double-speak play: they push a large “refund” to your account (or claim they did), then insist you return the “mistake” with a hard-to-reverse method. The deposit may be fake, stolen, or later clawed back, leaving you short.
Worked example: the $799 “Apple refund”
Lee sees a browser lock screen: “Apple Security: call +1-888-… immediately.” The voice walks Lee into downloading AnyDesk, “finds” fake malware, then says Apple owes a $799 goodwill refund. A bank screen-share shows a temporary credit. The agent says the credit was a system error and Lee must buy $799 in Apple Gift Cards and read the numbers to “clear the balance.”
Lee hangs up, force-quits the browser, and runs a legitimate malware scan offline. No gift cards bought. If PINs had been read aloud, those funds would be gone. See Gift cards and prepaid debit risks. P2P “send it back” pressure: Zelle and P2P payment scams.
Government-flavored cousins (IRS, SSA, unemployment): Fake IRS and benefits scams.
Red flags (stop immediately)
- Pop-up or cold call demands you do not hang up
- Payment in gift cards, crypto, wire, or cash apps
- Request for remote access to “fix” a consumer PC
- Claim that a refund was sent in error and you must return it differently than you paid
- Caller refuses to let you dial the company back on a number from the device or official site (spoofed support numbers)
- Search ads that mimic Apple/Microsoft URLs with extra syllables
First-hour recovery if you engaged
- Disconnect from the internet; uninstall unknown remote-access tools.
- From a different device, change bank, email, and Apple/Google passwords; enable MFA.
- Call your bank/credit union using the number on your card; ask to reverse recent sends and flag fraud.
- If gift-card PINs were shared, contact the card issuer’s fraud line immediately (recovery is rare).
- Report at ReportFraud.ftc.gov and to IC3.gov when money moved.
- Consider a credit freeze if you shared SSN or full account numbers.
Checklist
- Never call a number inside a threat pop-up.
- Type support URLs yourself or use the Apple/Microsoft app menus.
- Refuse gift-card or crypto payment for “support” or “refunds.”
- Do not grant remote access to unsolicited callers.
- Hang up and verify using a known-good number.
- Teach household members the refund-overpayment script.
Educational only. Not legal or fraud-recovery advice. If you lost money, contact your financial institution and file official reports promptly.