The refund scam that asks you to uninstall your antivirus, then writes down which one

Fifty of the findings these pages display are fixed text, sitting in blocks the developer labelled as fake checks ^[7]. The genuine browser data the page reads is what makes them land: user agent, screen dimensions, device memory, processor count, permission states, network information and page timings all come back correct ^[6], so the assertion that your kernel page-table isolation is inactive or that no Trusted Platform Module was found arrives wearing the same clothes ^[8].

The arithmetic gives it away. The score is constrained in code to between 13 and 30 out of 100 ^[10], which leaves the whole diagnostic a seventeen-point range ^[18] on a scale where passing is not an available result ^[10]. Malwarebytes ran it against a fully updated test browser and got "possibly outdated" ^[11]. An encrypted connection is reported as a downgrade risk, and cookies produce a warning when enabled and a failure when disabled ^[12]. Two scans of the same machine minutes apart disagree about how far behind its patches are, because that number is generated at random each time ^[9].

The instruction to uninstall is the part worth an operator's attention. It clears the path for remote-access software and anything else installed during the session, and it hands the scammers the name of the product that was there ^[13]. That answer goes into a list of 28 named products plus an Other option, and enterprise security software is among them ^[14].

Nothing in that sequence is technical. No exploit, no driver abuse, no signed binary killing a service. The licensed user removes the agent themselves, deliberately, while on a call with someone holding an Agent ID ^[17]. Consent is the hardest condition for tooling to argue with, and it is the whole mechanism here.

The pitch works because it bends something true by one degree. Microsoft Defender Antivirus can move into a passive state when a compatible third-party product is installed ^[15], so a user who has noticed that in Windows Security has already half-assembled the story the site is selling. Microsoft still supports third-party antivirus, and no legitimate refund requires removing security tools or installing remote access ^[16].

The form after the scan settles the question of who this is built for. It asks for bank name, cryptocurrency username, refund amount and reason, and the ID and password for a remote-access session, with 30 tools to choose from ^[1]. It also requires Agent ID, Agent Name and Company ^[17], which are fields you complete when you are the one placing the call. Eleven near-identical sites on one host ^[2] is the same fact from the other end: the scan is the intake form, and the call is the product.