The "your antivirus renewed" call, and how close I came

#1quilterjean(Joined Sep 2025 · 22 posts)November 12, 2025, 2:08 pm

Posting this while I'm still embarrassed, because if I wait until I'm over it I'll talk myself out of sharing.

Tuesday morning, phone rings, a very polite man from "the security company" tells me my antivirus has auto-renewed for several hundred and the charge will hit my account today unless I claim the refund now. He knew the brand I actually use, or guessed it, I still don't know which. He was patient, never pushy, apologised twice for the inconvenience. To process the refund he needed me to install a "support tool" so he could do the paperwork on his side. I was mid-download, program half installed, when my daughter rang on the other line and I told him I'd call the company back after.

The change was instant. All that patience vanished and he got sharp with me, "the refund window closes, you'll be charged, I'm trying to HELP you". That tone flip is what saved me, not cleverness. I hung up, my grandson later confirmed the "tool" was remote access software.

I've read about these calls in the papers for years and always quietly thought it wouldn't work on me. It nearly did. Sharing so you can laugh and learn.

#2tomd52(Joined Jun 2025 · 15 posts)November 13, 2025, 9:31 am

Nothing to laugh at, Jean, that's a professional operation and you found the exit. Mine didn't have an exit: trailer listed at a genuinely believable price, seller "had lots of interest" but a deposit would hold it until the weekend. Sent the deposit Thursday night. Friday morning the listing was gone, the account was gone, and so was my money.

Reported it, bank couldn't pull it back, and I spent about a month feeling like an idiot before I decided that feeling was the least useful thing I owned. These people do this all day, every day, against folk doing it for the first time. You didn't do anything stupid and neither did I. We met professionals.

#3Grace H(Joined Mar 2025 · 31 posts)November 13, 2025, 5:12 pm

Same script called me in October, almost word for word, down to the apologising. I hung up early and STILL spent the afternoon feeling rude about it. That's the part that gets me, they weaponise our politeness and then we feel guilty for the hang-up. Never feel rude. A real company survives you calling back on the number from their website.

#4Dana WhitakerFraud examiner(Joined Feb 2025 · 89 posts)November 15, 2025, 10:26 am

quilterjean said:

That tone flip is what saved me, not cleverness.

Jean has put her finger on something diagnostic, so let me unpack the mechanics for everyone who'll get this call eventually, and statistically most of you will.

The refund pretext works because it inverts the threat: they're not asking you for money, they're offering yours back, which switches off the suspicion most people carry toward strangers asking for payment. The remote-access "support tool" is the real objective. Once it's installed, the script usually moves to a staged "overpayment", they fake refunding too much, show you a doctored screen, and press you to return the difference, and now the money is moving in the direction that was the point all along. Every beat of it is rehearsed, A/B tested across thousands of calls, and aimed at courteous, competent people. Intelligence is not the defence; distance is. Any unexpected call that ends with software installed or money moved is a hang-up-and-call-back-yourself situation, every time.

And the tone flip: manufactured urgency is load-bearing for these scripts, so the moment you introduce a delay ("I'll call back", "let me check with someone"), the mask slips. Treat anger at a pause as a confession. The site's guide on tech support scams walks through the full script, including the refund and overpayment variants, and it's worth sending to anyone you love who answers unknown numbers.

Also seconding Tom: no self-blame in this section. Near miss or direct hit, the fault sits with the operator, not the target.

#5quilterjean(Joined Sep 2025 · 22 posts)November 16, 2025, 8:44 am

Thank you all, especially Tom for saying the quiet part. My daughter and I have set up call screening on my phone, and we've agreed I don't install anything or move anything the same day someone asks, no matter who they claim to be. The quilting group gets this story at Thursday's meeting whether they want it or not.