Scam emails that claim to be from big, trusted brands like Apple, Microsoft, McAfee, or “Geek Squad Billing Support” are a common phishing tactic that continues to target families, students, and older adults alike. They usually follow a familiar pattern: a sudden “urgent” message saying your account or credit card has been charged a large amount of money, and that you must call a phone number immediately to cancel it.
On the surface, these emails can look convincing. They often copy logos, formatting, and even fake customer service case numbers. But their real goal is not to protect your account, it’s to start a conversation with you.
The “Fake Charge” Hook
The message typically says something like:
- “Your subscription has been renewed for $399.99”
- “Unauthorized purchase detected”
- “Call immediately to cancel or refund”
This is intentional. The scam relies on a strong emotional trigger of concern about money. The idea is to push you into reacting quickly before you have time to think or verify anything.
In reality, legitimate companies like Apple or Microsoft do not handle billing disputes through random phone numbers listed in emails. They direct users to official apps or websites.
What Happens When You Call the Number
When someone calls the number in the email, they’re usually connected to a scam call center. These operations are often structured, scripted, and designed to sound professional. The person on the phone may sound calm, helpful, and “technical.”
At this stage, the goal shifts from fear to trust-building:
- They “confirm” your name or email
- They claim they can help reverse the charge immediately
- They may transfer you to a “senior technician” or “refund specialist”
Then they guide the victim toward installing remote access software such as:
- AnyDesk
- TeamViewer
- ConnectWise Control
Remote access tools are first used to give them live control of your device during the call, allowing them to operate it as if they were you. The access is presented as needed to “process the refund” or “secure your account,” when in reality it lets them open files, run tools, and control what you see on your screen in real time.
The Command Prompt Tactic (The “Tech Theater” Stage)
Once remote access is active, the scam often shifts into a highly technical-looking performance.
The caller will open built in system tools on the victim’s computer, such as the Command Prompt (black window with white text or scrolling text during their “use”)
They may quickly type commands in Command Prompt and generate lists of network connections or system data.
Then comes the key manipulation: they reinterpret normal system output as danger.
For example:
- A list of IP addresses is labeled as “hackers connected to your network”
- Regular background connections are described as “active intrusions”
- Normal Windows system activity is called “malware communication”
- Routine logs are presented as “evidence of a breach”
To someone unfamiliar with these tools, the fast moving text and technical language can feel very convincing. But nothing being shown is proof of hacking. It is normal system information being misrepresented in real time.
The Fear Narrative They Build
Once they “find” these supposed threats, the call typically escalates:
- “Your network is fully compromised”
- “Hackers are actively inside your system”
- “Your banking data is being stolen right now”
- “We need to fix this immediately”
This is designed to keep the victim focused on the screen and the caller, instead of stepping back to verify independently.
In reality, the “threats” they are showing are usually just standard system processes interpreted out of context.
Why This Works So Well
This stage is effective because it combines:
- Familiar system tools most people don’t normally open
- Fast typing and technical language
- Confident explanations from the caller
- A sense that something is being “discovered live”
It’s less about actually finding problems and more about shaping how the victim interprets what they see.
What They Don’t Want You to Do
These scams start to fall apart when the pace slows down:
- Hanging up and calling the official number from a trusted website
- Checking transactions directly through banking apps
- Refusing to install remote access software
- Getting a second opinion from someone else
Legitimate companies will never use Command Prompt or network logs to prove a billing issue, and they will never require remote control of your device to issue a refund.
A Family-Friendly Way to Stay Safe
A simple habit helps a lot here: verify before reacting.
If something claims there is a charge or urgent problem:
- Go directly to the official website or app
- Contact support using known numbers, not email links
- Pause before installing any software someone on the phone recommends
It can also help to treat any “urgent tech problem + phone number + refund promise” as something that needs a second check, not immediate action.
The Bigger Picture
These scams are part of a broader system of impersonation and pressure tactics. The tools they use like email, phone calls, remote access software, and system utilities like command prompt are all legitimate tools. The deception comes from how they are framed and interpreted during the interaction.
Once you recognize the pattern, it becomes easier to see what’s happening in real time: not a security emergency, but a scripted attempt to guide attention and decisions in a specific direction.
And that awareness is what makes the difference. It puts control back in the hands of the person on the other side of the screen.