How to Spot a Fake Tech Support Refund Scam

If someone calls or emails you out of the blue saying you're owed a refund, it can feel like good news. Maybe they say you overpaid for antivirus software, or a computer repair you don't remember booking. They sound friendly and official. But this is one of the most common scams aimed at seniors right now, and it almost always ends the same way: with the scammer trying to get into your computer or your bank account.

You're not being careless if this fools you for a minute. These calls and emails are built to sound routine, and the people running them do this all day. Once you know the pattern, it's much easier to spot.

Here's what the tech support refund scam looks like, why it works, and what to do if it happens to you.

What the refund scam looks like

It usually starts one of two ways:

An email or pop-up says you were charged for an antivirus renewal (often naming a real company, like Norton or McAfee) and gives you a phone number to call if you didn't authorize it.
A phone call says you're owed money back for something: a tech support job, a software subscription, or an overcharge the caller "just noticed."

Once you're on the phone, the caller sounds helpful. They say they need to connect to your computer to process the refund, and they walk you through installing a remote-access program, which lets them see and control your screen from somewhere else. Then one of two things happens:

They open your bank or payment account on screen and claim they "accidentally" refunded you too much. They ask you to send the difference back, often through a wire transfer, gift cards, or an app like Zelle.
They quietly move money out of your account while you watch a fake-looking screen that claims a refund is "processing."

Either way, the money goes to the scammer, not back to you.

Why it works

The scam works because it doesn't feel like a scam. Nobody is threatening you. They're offering you money, which lowers your guard. And once they're connected to your computer, everything you see on screen is something they control, including fake bank balances or error messages that create urgency to act fast.

Warning signs to watch for

A call or message about a refund or overcharge you don't remember agreeing to.
Any request to install a remote-access program so someone else can see or control your computer.
Being told to "send back" an overpayment, especially using gift cards, wire transfers, or Zelle.
Pressure to act immediately, or being told not to hang up and check with anyone else first.
A phone number in an email or pop-up instead of one you looked up yourself.

A real refund from a real company never requires you to install software on your computer or send money anywhere.

What to do if you get a call or message like this

Don't call the number in the email or pop-up. If you think a charge might be real, look up the company's number yourself, from their actual website or your account statement.
Don't install anything someone asks you to install during an unexpected call. That includes anything described as "remote access," "remote support," or "screen sharing."
Hang up or close the message. You don't owe anyone an explanation, and a real company will not be upset that you want to verify first.
Talk to someone you trust before sending any money, especially gift cards, wire transfers, or Zelle payments, which are very hard to get back once sent.

PorchswingProtect is built for exactly this: it's made for seniors, works quietly in the background on your Windows or Mac computer, and blocks the remote-access programs scammers use to get into your computer in the first place. It also closes scary pop-ups and fake virus warnings before they can lead to a call like this. And if you ever have a question, there's a real US-based Porchswing person to call, not a chatbot.

What to do if you're stuck

If someone already connected to your computer, or you already sent money, you are not the one at fault here. The sooner you act, the better the outcome tends to be.

Disconnect your computer from the internet (turn off Wi-Fi, or unplug the cable).
Call your bank or card company right away to flag the transaction and ask about reversing it.
Change your passwords from a different, trusted device.
If you'd rather have someone walk through the cleanup with you in person or remotely, Porchswing's hack and scam cleanup service can check your computer over and help you get back to normal. PorchswingProtect pairs well with that cleanup, but it doesn't replace it if something has already gone wrong.

If you want quiet protection on your Windows or Mac computer — with a real Porchswing person to call — learn about PorchswingProtect. Or call us at (916) 521-0065 and we'll help you set it up.

Common questions

Can a real company actually owe me a refund?

Yes, that part can be true. The scam isn't in the idea of a refund, it's in how they ask you to collect it. A real refund goes back the same way you paid, without you installing anything or sending money anywhere.

What if I'm not sure whether a call was real?

When in doubt, hang up and call the company back using a number you find yourself, not one given to you during the call. Take your time. A legitimate company will still be there when you call back.

Is this the same as a gift card scam?

It's related. Many refund scams end the same way a gift card scam does, with a request to send money in a form that's hard to trace or reverse. The giveaway in both cases is being asked to pay or "return" money in an unusual way, under pressure.