The $2,000 Refund Scam That Cost a Small Business a Month of Work

Hackers & Hooks | Season 1, Episode 12

An employee at a small company opened an email that looked like it came from Amazon. It asked him to verify a $2,000 phone purchase he had never made. So he did what felt responsible: he called the number in the email. By the time he hung up, a stranger had spent an hour inside his computer, and the company was on its way to losing a month of work.

Manny Fu of Impact CIO Services shared this story with Nick Gipson on Hackers & Hooks. Manny is a fractional CIO (chief information officer), and his firm also provides light managed IT support. As he describes it, his job is helping business owners make technology decisions that protect the business and support its growth.

The Refund That Was Really a Remote Access Scam

The man who answered posed as Amazon support. Since the purchase was not legitimate, he said, the $2,000 would be refunded to the employee’s credit card. While still on the call, the employee checked his card and saw a $2,000 credit. That small proof bought a lot of trust.

Then the caller raised a new worry: there had been a lot of hacking lately, and he needed remote access to make sure this did not happen again. The employee let him in. The session ran for about an hour. When it ended, the caller declared the machine virus-free and hung up.

Something nagged at the employee, so he checked his card again. The $2,000 credit had been reversed. Moments later, a message appeared on his screen: Windows updates were being applied, do not turn off your computer. It looked real, but the font and placement were slightly off, sitting a little too high on the screen. He left it alone, shut the computer down at the end of the day, and found the same message waiting the next morning. That is when he called Manny.

Manny told him to power the computer off immediately. His scan of the machine confirmed it had been compromised. Whatever the attacker used was new enough that the company’s conventional antivirus did not catch it.

“Nobody except for a legitimate MSP or cyber person is ever going to ask you to remote into your computer legitimately. It just doesn’t happen.”

Manny Fu, Hackers & Hooks

One Phone Call, a Week Offline, and a Month of Lost Work

The first mistake was trusting the email’s contact details. Manny’s advice: however legitimate a message looks, go to a source you know is real, such as the company’s own website or app. Nick added that searching for a support number is no safer. The FTC agrees, warning that toll-free numbers that pop up in a search are not always legitimate customer service lines.

The second was granting remote access, which gave a stranger an hour inside a business computer.

The cleanup is where the real cost showed up. The computer had to be wiped and rebuilt, and the employee was without it for almost a week. Manny had previously recommended bare metal backups, which capture the entire computer (operating system, settings, and files) so it can be restored to the moment before a failure. The company had passed. Their reasoning, as Manny recalled it: they had never been hacked and were too small for anyone to want. Manny sees it the other way around. Being small makes a business more of a target.

The only backup was a manual copy on an external drive. The employee believed it was from the last two weeks. It was a month old. A month of estimates, spreadsheets, and other work was gone.

Manny stressed that the impact went well beyond one laptop: delayed customer work, irritated customers, and an employee on the payroll who could not work. Nick connected this to reputation, pointing to Target’s 2013 breach, which affected about 40 million payment card accounts, as a reminder that lost customer trust can cost more than the technical cleanup.

Afterward, the employee asked if they could buy the bare metal backup now. Too late: a restore depends on a full backup taken before the incident.

“It’s kind of like car insurance. You don’t buy it after an accident. You buy it beforehand in the event that something bad happens.”

Manny Fu, Hackers & Hooks

The company is now rolling out bare metal backups and endpoint detection and response (EDR) on its computers. Manny described EDR as a step above traditional antivirus: it watches behavior, monitors more broadly, and includes tools to investigate and respond.

Nick added context on the power-off call. In this case it was the right one: the compromise was persistent, and if it had been ransomware, every minute running could mean more encrypted files. When possible, Nick prefers that a suspect machine be cut off from the network, for example with airplane mode, so investigators can still see what is running. If you cannot isolate it, turn it off.

Lessons for Small Businesses

• Verify through a channel you already trust. Skip the phone number or link in a suspicious email, and the first number a search engine shows you. Go to the company’s official website or app and check your account there.
• Never give remote access to an unexpected caller. Only your own IT provider or security team should connect to your computers, and only through a process you set up in advance.
• Automate your backups and test them. Manual backups slip. Use scheduled backups that include full system images, confirm they run, and keep a copy separated from your main network. Nick has seen ransomware spread straight into backups that sat on the same network.
• Back up your cloud email and files too. Manny pointed out that Outlook mirrors the mail server, so messages deleted there vanish from your screen as well. A separate Microsoft 365 backup protects against that.
• Look beyond basic antivirus. Behavior-based tools like EDR, with people watching the alerts, improve your odds of catching new threats that traditional antivirus misses.
• Disconnect first, then call for help. Take a suspect device off the network (or power it down if you cannot) and call your IT provider or an incident responder before wiping anything.

How Gipson Cyber Helps

Manny’s closing advice was to have someone who understands both your business and your technology and knows how to make them work together. Gipson Cyber takes the same approach on the security side: we work alongside the IT provider or MSP you already have, not in place of them.

Our Business SOCaaS provides 24×7 monitoring with real human responders, using the tools you already have, with clear reporting. If something gets through, Business DFIR is our small business incident response service, delivered by real people who work with your existing technology. No security program can stop every attack, but preparation can shrink the damage and the downtime. If you think you have been hacked right now, go to 800cyber.com.