Scam Number: + 1 888 252 6870
Scammer’s Website or Email:
Additional information about this scam:
Michael from Geeksquad
support.me for LogMeInRescue client.
Carrier: RingCentral
Call Center Location: India 
Answers as: “Geek Squad”
Technician: “Michael”
Falsely Claims: All computers come with “free trials to Geek Squad Services”
Remote Access Software: ConnectWise from atrcare.help (Nickname: “Cancellation Server/Robotic server” Code: 05408, IP: 78.40.117.18), an iFrame of axgdfr3.top (IP: 93.157.106.98 
), ScreenLeap or UltraViewer (75306871/DESKTOP-RALOVP7, LAPTOP-JR87EIAM)
I faked the ConnectWise download not working, so “Michael” asked me to share my screen via ScreenLeap and then ask me to download ConnectWise. I refused, and “Michael” had me instead download UltraViewer
- Once he remotely connected to my virtual machine, “Michael” asked me to fill out a “cancellation and refund form,” which shows that the scammers also impersonate Microsoft, Venmo, PayPal, Webroot, Apple, McAfee and Norton.
- I was then asked to log into my noneixstent bank account. But since I don’t do online banking, I was almost asked by their supervisor to give them remote acess to my cell phone before they ultimately decided to call me back on my Google Voice line from their personal Magic Jack line (408) 256-6067.
- Once I answered, I was once again asked to log into my nonexistent bank account before they attempted to install ConnectWise on my virtual machine, even going as far as to disable firewall, while I was asked to write down their “refund code,” RNVC59T9N5V.
- The scammer then opened the Command Prompt to then have me fill out my banking information to their “Chase Live Server” so they can initiate a “$3,000 transfer.”
- The scammer then tried to interrogate me and view my webcam, so I told him off and he hung up on me.
ASSOCIATED CONNECTWISE DOMAINS:
- mntcare.help
- qsdcare.help
- kmncare.help
- dstcare.help
- ps2help.live
- w4help.cc
- nzacare.help
- sr2help.live
- zmrhelp.live
- hmcare.live
- stuhelp.live
- jdd33ha.top
Kolkata IP of course:)
Details…
"ip": "116.206.222.221",
"security": {
"vpn": false,
"proxy": false,
"tor": false,
"relay": false
},
"location": {
"city": "Kolkata",
"region": "West Bengal",
"country": "India",
"continent": "Asia",
"region_code": "WB",
"country_code": "IN",
"continent_code": "AS",
"latitude": "22.5180",
"longitude": "88.3832",
"time_zone": "Asia/Kolkata",
"locale_code": "en",
"metro_code": "",
"is_in_european_union": false
},
"network": {
"network": "116.206.220.0/22",
"autonomous_system_number": "AS23860",
"autonomous_system_organization": "Alliance Broadband Services Pvt. Ltd."
}
}
Oh, my. Do people actually not notice how badly these are written?
I Thought Everyone Knew Correct Grammar Was To Capitalize Every Word In Every Sentence
Receiving A Receiver('s) link Is Also Totally Normal On Every EFTPOS Payment Transfer Or Chargeback('s)
Callback number for the aka (Refund Manager)
408-256-6067
October 31th 