A short, plain-English explainer for the adult child of an older parent. What a tech support refund scam is. How a popup tech scam turns into a FedEx envelope full of cash. And the one move that ends it.
TL;DR. A tech support refund scam starts with a pop-up that says your parent's computer is infected and gives a number to call "Microsoft" or "Geek Squad." A fake technician takes over the screen, stages a refund, then "accidentally" overpays. The screen now shows tens of thousands of dollars that were never really deposited. The technician begs your parent to mail the difference back in cash, wrapped in magazines, by FedEx. The defense is simple. Never let a popup pick the phone number. Never let a stranger touch the screen. Hang up.
Why did we write this guide?
This is for the daughter who is 52, lives in Brooklyn, and whose dad in Sarasota saw a Microsoft pop-up at 8 a.m. on a Tuesday. The screen was red, the speakers were beeping, and a calm voice on a 1-800 number was already walking him through "the diagnostic."
The FBI's 2025 IC3 Elder Fraud Report, released in April 2026, names tech-support scams the largest fraud type impacting adults 60 and older. Aggregate U.S. losses crossed $1 billion in 2025 alone (see ic3.gov/AnnualReport/Reports and ic3.gov/crimeinfo/elderfraud).
So this article is for that. About a seven minute read, landing on a rule you can text your dad before bed.
What is a tech-support refund scam, exactly?
A tech support refund scam is a pop-up plus a phone call plus a remote-access session. The pop-up claims your parent's computer is infected and lists a number for "Microsoft," "Apple," "Geek Squad," or "Norton." The page is a web ad.
When your parent calls, a "technician" asks them to install AnyDesk or TeamViewer and takes over the screen. The FTC's consumer alert on tech-support scams describes this opening as the most common entry point for the category (consumer.ftc.gov/articles/how-spot-avoid-and-report-tech-support-scams).
So far this is the classic Microsoft refund scam pattern. The new wrinkle, the one driving the 2026 surge, is what happens next. The technician stages a refund, overpays "by mistake," and asks your parent to mail the difference back in cash by FedEx.
How does a tech-support scam call usually go?
The pattern is consistent enough that it is worth writing down. The FBI's Columbia field office PSA on the cash-by-FedEx variant describes the same six-step sequence reported by victims across the country (fbi.gov/columbia/news).
- The pop-up takes over the screen.
First, the browser locks up. A red banner says the computer is infected and lists a 1-800 number for "Microsoft" or "Geek Squad." The page will not close.
- The "technician" runs a fake scan.
Next, your parent calls and is talked through installing AnyDesk or TeamViewer. The technician opens Event Viewer and points at routine warnings as proof of a "Trojan."
- The story turns into a refund.
Then the technician says the antivirus that caused the problem is being cancelled, with a $399 refund today. They open what looks like a bank portal inside the screen-share.
- The "accidental" overpayment.
After that, the technician fat-fingers the amount. The screen shows $39,999 deposited instead of $399. The voice on the line panics, "I will lose my job, please help me."
- The cash leaves the house.
Finally, your parent is asked to withdraw the difference in cash, wrap it in a magazine inside a FedEx envelope, and ship it to a P.O. box. The deposit was a fabricated overlay. No money ever moved.
Why is the FedEx-cash variant surging in 2026?
For years, the tech support scam endgame was a gift card run or a wire to an offshore account. Banks got better at flagging both. So criminals moved to cash by mail.
The FBI's Columbia PSA describes the surge. Cash wrapped in magazines is invisible to bank fraud filters, ships in a normal envelope, and clears the country before anyone notices the on-screen deposit was a fake refund overpayment scam (fbi.gov/columbia/news).
Furthermore, the Department of Justice has charged multiple India-based call-center rings running this exact script (justice.gov). Indeed, the Better Business Bureau's Scam Tracker logs hundreds of fresh tech-support reports each month, and cash-by-mail now dominates new entries (bbb.org/scamtracker).
No real tech-support company will ever ask your parent to mail cash. Not in an envelope, not in a magazine, not in any shape.
Why does an overpayment story override common sense?
For thirty years the standard guidance was "do not click the link, do not call the number, and never give a stranger access to your computer." AARP's Fraud Watch Network still names that pattern as the most-taught defense (aarp.org/money/scams-fraud/info-2024/tech-support-scams.html).
However, a tech support refund scam defeats that habit. The pop-up arrived without being clicked. By the time the "overpayment" lands, the target has been on the call for forty minutes, and the polite voice feels like a coworker.
Then the script flips. Instead of "give me your money," the technician says "help me, I made a mistake, I will get fired." Most older adults raised to be polite will move heaven and earth to help a young person who sounds like they are crying. In particular, that pivot is the entire point of the fake refund overpayment scam.
Moreover, bank fraud alerts fire on outgoing wires, not on outgoing FedEx envelopes. AARP's helpline at 1-877-908-3360 is excellent, and it is reached, almost always, after the package is in the mail (aarp.org/money/scams-fraud).
What can I do this week to stop a tech-support refund scam?
The smallest possible intervention. Sit down with your parent this Sunday and write two rules on an index card. Put the card on the fridge in marker thick enough to read without glasses.
First rule. A pop-up never picks the phone number. If a screen says to call Microsoft or Geek Squad, close the laptop and call your adult child instead. The real number, if you ever need it, lives on the back of the device or the original receipt.
Second rule. No stranger ever touches the screen. No AnyDesk. No TeamViewer. If anyone on the phone asks to remote in, the call ends. Indeed, this is a good place to teach the family word, the small shared phrase your family agrees on so a panicked parent has one quick way to ask for help without explaining everything first.
The five-minute conversation:
- Sit with your parent at the kitchen table, laptop closed.
- Write two rules on an index card: "A pop-up never picks the phone number" and "No stranger touches the screen."
- Put the card on the fridge.
- If a pop-up appears, close the laptop and call you, not the number on the screen.
- If a refund ever comes up on a tech call, hang up and call you back on a number already in their phone.
Why this small fix works against tech-support scams
A criminal with a polished pop-up can imitate Microsoft for the length of a phone call. However, they cannot answer the phone when your parent calls you instead. The whole attack depends on keeping the target on this call. The defense is to end the call and pick up a different phone.
Common questions about tech-support refund scams
The pop-up said Microsoft. How can that be fake?
It is a web ad. Anyone can buy ad space and design a page that looks like a Windows error. Microsoft does not put phone numbers in pop-ups, and neither does Apple, Geek Squad, or Norton (consumer.ftc.gov).
The refund showed up on the screen. Isn't that proof?
No. The deposit was a fabricated overlay inside the screen-share. The criminal controls what your parent sees because the criminal controls the screen. A real refund lives in the bank's own app, opened on your parent's own phone.
What if my parent already let someone into the computer?
Then close the laptop, unplug it, and call you. From a different device, change the passwords on the email, the bank, and any account opened during the session. Then call the bank on the number on the back of the card (consumer.ftc.gov/articles/what-do-if-you-were-scammed).
What if a FedEx envelope of cash is already in the mail?
Call FedEx and ask to intercept the package using the tracking number. Then file at the FBI's IC3 at ic3.gov and the FTC at reportfraud.ftc.gov. AARP's helpline at 1-877-908-3360 walks a family through next steps.
Do we need antivirus or a special app?
No. The threat is a phone call started by a pop-up. The defense is a rule on an index card. The rule is the tool.
Where to go next
The Resources library has printables you can tape to the fridge, including a "two rules for pop-ups" card. Related explainers: What is an AI voice clone scam?, When the bank fraud department calls, and The "secure your account" gift card scam. The follow-up piece, After the call, walks through the first hour if money has already moved. The kit page explains how the fridge magnet, wallet card, and family-routed number fit together.
