A pop-up or a call about an infected computer, remote access, and a bill that has to be paid in gift cards.
How it works
It begins with a full-screen warning that will not close, or a call from someone claiming to be from a company whose name everyone knows. The message is that the computer is compromised and that acting now matters.
They ask to connect remotely to "check." Once connected they show something alarming — an ordinary system log, usually, which looks damning to anyone who has not seen one before. Sometimes they open a banking page to "verify a refund" and appear to send too much, so the mark now owes money back.
Payment has to be a gift card. The reason given is nonsense, and it changes if questioned. The real reason is that gift cards are irreversible, anonymous, and can be drained the moment the numbers are read aloud.
The instruction to buy several cards across a few different shops is not incidental. It is how they stay under the limits cashiers are trained to notice — which means the person is often coached, on the phone, to mislead a shop assistant who is trying to help them.
What it looks like
The hardest thing to believe about any of these is how ordinary the first message is. This is a composed reconstruction — not a real exchange — showing the shape the conversation usually takes.
What it looks like on a bank statement
- Gift-card purchases from a card that does not normally buy them.
- Several of them in the same short stretch rather than one.
- Often across different retailers, or repeated visits to the same one.
- The purchases look completely ordinary in isolation. It is the bunching that reads as wrong.
What to do
- Keep the cards and the receipts, even drained ones. Some issuers can freeze a balance that has not been spent yet, and the receipt is what makes that call possible.
- Call the gift-card issuer directly — the number on the back — and then the retailer. Speed decides this one.
- Disconnect the computer from the internet and have someone remove the remote-access software they installed. It is still there.
- If they were shown a banking page, treat the bank credentials as exposed: new password, and a call to the bank.
- Nobody legitimate is paid in gift cards. Not a company, not a court, not a utility, not a government agency. There is no exception, which makes it a useful rule to leave with someone.
Also called
refund scam · computer virus scam · pop-up scam
Not sure about a message you already have?
Paste the text, the email, or just the link into Second Look. Rowan reads it and tells you what it sees, in plain English. Free, and no account.
Watching for this on someone else’s account
Rowan reads an aging parent’s bank statements for this pattern and four others, and tells you when there is something worth a call — with the reasons, and with what to say when you make it. Read-only: it can see, but never move, money, and there is nothing for her to install. See how it works.