Tech Support Scam Follow-up Attempt

Initial Incident (Week 1)

• Fake Microsoft support call
• Remote access attempted
• $299 fee requested
• Scam avoided, reported

Follow-up Attack (Week 3)

Call Details

Caller: "John Smith, Refund Department" Claim: "We processed your refund in error, need you to return funds" Urgency: "Must resolve in 24 hours or account suspended" Method: Gift card payment (again)

Social Engineering Tactics

1. Credibility: Knew details of initial scam attempt
2. Authority: Claimed to be from "legitimate refund department"
3. Urgency: Artificial deadline pressure
4. Reversal: From taking money to giving money (psychological trick)

Investigation

Caller Information

• Same accent as initial scammers
• Call from different number (also spoofed)
• Mentioned specific details only scammers would know
• Same request for gift cards

Pattern Recognition

1. Double Dip Strategy:
   • Initial attempt: Direct theft
   • Follow-up: Refund reversal scam
2. Targeting: Previous victims marked as vulnerable
3. Timing: 2-4 weeks after initial contact
4. Psychology: Uses victim's hope for resolution against them

Response Protocol

Immediate Actions

1. Engagement: Played along briefly to gather info
2. Information Gathering:
   • Requested callback number (fake)
   • Asked for reference number (provided)
   • Inquired about "official" website (not provided)
3. Termination: Ended call after sufficient evidence

Reporting Actions

1. Law Enforcement: Updated initial report with new information
2. Carriers: Additional numbers to block
3. Community: Warned others about follow-up scams
4. Platform: Filed detailed Quiet-Report

Technical Analysis

Call Infrastructure

• VoIP providers changed
• Number spoofing patterns similar
• Likely same criminal group
• International calling patterns

Data Handling

• Victim information retained by scammers
• Used to build credibility in follow-up
• Potential for additional scam variations

Protective Measures Implemented

Personal

• Changed phone number handling procedures
• Implemented verification checklist for all unsolicited calls
• Enhanced call screening

Community

• Shared warning in local groups
• Created guide for scam follow-ups
• Worked with senior center on education

Legal

• Provided additional evidence to investigators
• Connected with other victims
• Supported class action investigation

Impact Assessment

Risk Level: Medium (targeted follow-up) Success Rate: Likely higher than initial scam Psychological Impact: Increased frustration but better preparedness

Recommendations for Previous Victims

1. Expect follow-up attempts
2. Never engage with callers about previous scams
3. Report all follow-up contacts
4. Share experiences to help others
5. Consider changing contact information if severe