1 The Anatomy of a Fake Refund Call
The most common version of this scam starts with an unsolicited phone call or email claiming that Apple has approved a refund you never requested. The caller ID often displays a real Apple support number, because voice-over-IP systems allow caller ID spoofing at zero cost. The scammer's script is consistent: they confirm your name, mention a recent purchase (usually a subscription or an app you actually bought, scraped from leaked data), and then say the refund of $99 to $499 has been approved but needs to be 'processed' to your bank account. This is the hook. Apple never calls customers to process refunds. Refunds are initiated exclusively through reportaproblem.apple.com by the account holder, and the money is returned to the original payment method automatically — never to a different account, never via bank transfer, and never with your help. If you receive a call about a refund you did not request, the correct action is to hang up. If you are worried it might be real, open a browser yourself, type support.apple.com manually, and start a chat there. Never use a phone number, link, or email provided by the caller.
假退款电话的完整套路
这类诈骗最常见的开头是一通未经请求的电话或邮件，声称 Apple 已批准一笔你从未申请的退款。来电显示常常是真实的 Apple 客服号码，因为网络电话可以零成本伪造来电显示。骗子的剧本高度一致：先确认你的姓名，提到一笔近期购买（通常是从泄露数据中抓到的你真实订阅或应用），然后说 99 到 499 美元的退款已批准，但需要'处理'到你的银行账户。这就是钩子。Apple 从不打电话给客户处理退款。退款只能由账户持有人通过 reportaproblem.apple.com 发起，款项自动原路退回原支付方式——绝不会退到其他账户，绝不通过银行转账，也绝不需要你协助操作。如果你接到一通关于你未曾申请的退款的电话，正确做法是挂断。如果担心是真的，自己打开浏览器，手动输入 support.apple.com，在那里发起聊天。永远不要使用来电者提供的电话号码、链接或邮箱。
A practical guide to the fake-refund scam pipeline: spoofed caller IDs, fake confirmation codes, remote access apps, and the exact verification steps that expose a scammer in under a minute.
拆解假退款诈骗全链条：伪造来电显示、假验证码、远程控制软件，以及一分钟内识破骗子的具体验证步骤。
2 The Gift Card and Confirmation Code Variants
Two variants dominate. In the gift card variant, the 'support agent' says the refund was accidentally processed for too much money — for example $3,000 instead of $300 — and asks you to return the difference using Apple Gift Cards or App Store codes purchased from a retail store. The justification sounds technical: 'the refund batch is locked until the balance is corrected.' No legitimate refund has ever worked this way. Apple cannot send you money by accident and then demand gift cards; gift card balances are irreversible and are the preferred endpoint of nearly every consumer fraud chain. In the confirmation code variant, the scammer triggers a real password reset or verification code on your account and reads the six-digit code to you over the phone, asking you to 'confirm' it. Reading that code to the caller is equivalent to handing over a one-time password. Apple's verification codes are only ever for your eyes and your own screen. The rule to remember: any request that involves gift cards, bank transfers, cryptocurrency, or reading a code aloud is fraud with no exceptions. The moment any of these is mentioned, the conversation is over.
礼品卡与验证码变体
有两种变体最普遍。礼品卡变体中，'客服'说退款被错误地处理多了——例如 300 美元误退成 3000 美元——并要求你用从零售店购买的 Apple 礼品卡或 App Store 充值码退还差额。理由听起来很技术化：'退款批次被锁定，直到余额纠正为止。'任何合法退款都不存在这种流程。Apple 不可能意外多打钱给你再索要礼品卡；礼品卡余额不可逆转，是几乎所有消费诈骗链的首选终点。验证码变体中，骗子在你的账户上触发真实的密码重置或验证码，然后在电话里要求你'确认'那六位数字。把验证码念给来电者等于交出一次性密码。Apple 的验证码只给你自己和你的屏幕看。要记住的规则：任何涉及礼品卡、银行转账、加密货币或大声念出验证码的请求，毫无例外都是诈骗。只要提到其中任何一项，对话即可终止。
3 Remote Access Software: The Escalation Stage
If the caller keeps you on the line, the next stage is remote access. The script asks you to install a legitimate-seeming remote desktop tool — commonly used brands include AnyDesk, TeamViewer, or a 'Apple Remote Diagnostic' web page that is actually a screen-sharing session. Once connected, the scammer does not need your password: they can watch you log into your bank, capture account numbers, and in some cases initiate transfers while you watch, disguised as 'processing the refund.' The defense is a hard rule: no one from Apple will ever ask you to install remote access software for a refund, a security check, or an account investigation. If you have already installed such software at a caller's request, disconnect the session, uninstall the application immediately, and then change the passwords of every account you accessed during the session — email first, because email is the recovery path for everything else. Then check your bank and App Store purchase history for transactions you did not make, and report the incident.
远程控制软件：升级阶段
如果你一直没挂电话，下一阶段就是远程控制。剧本会要求你安装一个看似正规的远程桌面工具——常见品牌包括 AnyDesk、TeamViewer，或一个'Apple 远程诊断'网页，实际是屏幕共享会话。一旦连接，骗子不需要你的密码：他们可以看着你登录网银、记录账号，有时甚至在你眼前发起转账，伪装成'处理退款'。防御是一条铁律：Apple 的任何人都不会为退款、安全检查或账户调查要求你安装远程控制软件。如果你已经在来电者要求下安装了这类软件，立即断开会话、卸载应用，然后修改会话期间访问过的所有账户的密码——先改邮箱，因为邮箱是一切账户的恢复通道。然后检查银行和 App Store 购买记录中是否有非本人交易，并举报此事。
4 How to Verify a Real Apple Support Contact in One Minute
Verification is always inbound, never outbound. Step one: hang up or ignore the email. Step two: on your iPhone, open the Settings app and tap your name at the top — the Support option there links directly to Apple's official support channels. Alternatively, type support.apple.com into a browser yourself; do not click any link from the message you received. Step three: if you want to confirm a refund status, sign in at reportaproblem.apple.com with your own Apple Account — refund status is visible there for every request actually filed. Step four: check whether Apple has ever contacted you by looking at your Apple Account settings, where legitimate security alerts appear in the message center. A real Apple communication never creates urgency, never asks for a code, and never requires payment to deliver money to you. If the person who contacted you objects to you calling back through official channels — 'the case will be closed in 15 minutes' — that objection itself is the confirmation that it is a scam. Legitimate support has no reason to fear verification.
一分钟内验证真正的 Apple 官方联系
验证永远是主动呼入，不是被动接听。第一步：挂断电话或忽略邮件。第二步：在 iPhone 上打开设置，点顶部你的名字——其中的'支持'选项直接链接 Apple 官方支持渠道。或者在浏览器中自己输入 support.apple.com；不要点击收到的消息中的任何链接。第三步：如果想确认退款状态，用自己的 Apple 账户在 reportaproblem.apple.com 登录——所有实际提交的退款请求状态都在那里可见。第四步：检查 Apple 是否联系过你——查看 Apple 账户设置中的消息中心，合法的安全警报会出现在那里。真正的 Apple 沟通从不制造紧迫感，从不索要验证码，也从不要求先付钱才能给你打款。如果联系你的人反对你通过官方渠道回拨——'案件 15 分钟后关闭'——这个反对本身就是骗局的确证。合法的客服没有理由害怕被验证。
"Verification is always inbound, never outbound."
「验证永远是主动呼入，不是被动接听。」
5 If You Already Fell for It: A Recovery Checklist
Act in this order, because each step protects the next one. First, if you shared a verification code or password, change your Apple Account password immediately from a device you trust, and sign out all other devices from Apple Account settings. Second, if you bought gift cards and shared the codes, the money is likely gone, but report the card numbers to Apple Support anyway — occasionally unspent balances can be frozen. Third, if you installed remote software, uninstall it before doing anything else online. Fourth, call your bank's fraud line (the number on the back of your card), report the incident, and ask about a chargeback for any unauthorized transaction — note that a chargeback against Apple for a scammer-guided purchase can lock your Apple ID, so explain the situation to the bank and ask them to flag it as third-party fraud rather than a merchant dispute. Fifth, report the scam: to Apple at reportphishing@apple.com, and to your local consumer fraud authority. Finally, enable two-factor authentication with a trusted phone number you control, and consider a recovery contact, so the next attempt fails at the first step.
如果你已经上当：补救清单
按这个顺序行动，因为每一步都在保护下一步。第一，如果你泄露了验证码或密码，立即在受信任设备上修改 Apple 账户密码，并在 Apple 账户设置中注销所有其他设备。第二，如果你购买了礼品卡并告知了卡号，钱大概率已无法追回，但仍应向 Apple 官方报告卡号——未消费余额偶尔可以被冻结。第三，如果你安装了远程软件，先卸载再进行任何在线操作。第四，拨打银行卡背面的银行欺诈专线，报告事件，并询问对未授权交易的拒付——注意，因骗子诱导的购买对 Apple 发起拒付可能导致 Apple ID 被锁，所以要向银行说明情况，请他们标记为第三方欺诈而非商户争议。第五，举报诈骗：向 Apple 的 reportphishing@apple.com，以及当地消费欺诈监管部门。最后，开启双重认证并绑定你自己控制的受信任号码，考虑设置恢复联系人，让下一次尝试在第一步就失败。
6 Why Scammers Keep Winning: The Psychology Worth Understanding
Every variant of this scam exploits the same three levers. Authority: the Apple brand, a real-looking number, and confident technical vocabulary make the caller feel official. Urgency: a refund that 'expires,' a case that 'closes in minutes,' or an overpayment that 'must be corrected today' removes the time you would otherwise use to think. Reciprocity: the promise of money arriving makes you cooperative, because refusing feels like losing something you were about to receive. Knowing these levers turns them into alarms. Any combination of an official-sounding contact + time pressure + money moving should trigger your hang-up reflex automatically. Teach this pattern to family members who are less technical — parents and grandparents are the primary targets of the gift card variant, and a two-minute explanation of 'Apple never asks for codes or gift cards' prevents more losses than any software setting. Print it and put it near the landline if you have to. The scam only works while it is unexpected; once the pattern is recognized, it is powerless.
骗子为何屡屡得手：值得理解的心理学
这类诈骗的所有变体都利用同样三个杠杆。权威：Apple 的品牌、看起来真实的号码、自信的技术术语，让来电者显得官方。紧迫感：即将'过期'的退款、几分钟后'关闭'的案件、今天'必须纠正'的多付款项，剥夺了你本可用来思考的时间。互惠：即将到账的钱让你配合，因为拒绝感觉像是失去即将得到的东西。认清这些杠杆，它们就变成警报。任何'官方联系的口吻＋时间压力＋资金流动'的组合都应自动触发你挂断电话的反应。把这个模式讲给家里不太懂技术的成员——父母和祖父母是礼品卡变体的主要目标，两分钟解释一句'Apple 绝不会索要验证码或礼品卡'比任何软件设置都能减少损失。必要的话打印出来贴在固定电话旁。骗局只在出乎意料时有效；一旦模式被识别，它就毫无力量。