Tech Support Scam: How It Works and How to Recover
Fake support agents who gain remote access and extract payments or 'refunds'. Also known as refund scam, remote access fraud.
Free case assessmentHow the fraud works
Tech-support scams use pop-ups or cold calls claiming your device is infected, then talk you into granting remote access. From there they 'find' problems and request payment, or open your banking and move money — sometimes staging a fake 'refund' that tricks you into sending funds back.
Warning signs
- Unsolicited 'virus' warnings with a phone number
- Requests to install remote-access software
- Being asked to log into your bank 'to receive a refund'
- Payment demanded in gift cards or crypto
- Claims you were 'overpaid' and must return money
Evidence to preserve
If you have been affected, gather:
- The remote-access tool name and session times
- Records of any payments made
- Screenshots of pop-ups or the 'refund' screen
- Phone numbers and caller details
- Bank statements showing the movements
How victims recover funds
The primary recovery route is card chargeback (visa / mastercard). A chargeback reverses a card payment by raising a dispute through the Visa or Mastercard scheme via your issuing bank, which claws the funds back from the merchant's acquirer under defined dispute reason codes.
Card payments may support a chargeback; bank movements should be reported immediately for recall. Removing the remote-access software and securing your accounts is the urgent first step.
Tech Support Scam recovery by country
Select your country for the local regulator, ombudsman and recovery routes: