Product: Credit card or prepaid card

On XX/XX/2021, XXXX XXXX XXXX XXXX XXXXXXXX XXXX XXXXXXXX received a call from a gentleman going by the name of XXXX XXXX, claiming that the XXXX XXXX was about to expire and that we needed to renew our subscription. Mr. XXXX then asked to gain remote access to the computer in order to upgrade the software. He did connect remotely and appeared to make several changes. He included a Note Pad file that showed the current software License Number and product number. He also included a XXXX XXXX XXXX XXXXXXXX XXXX number. The file also state that XXXX XXXX XXXX was active, that the Payroll Service was a privilege Membership and that the Software Agreement included 3 user licenses. The file showed XXXX XXXX as the account manager and listed two toll free numbers, XXXX and XXXX. XXXX requested payment via check and even offered to create the check in our XXXX system remotely. The check was printed, and XXXX requested that it be sent priority mail. The check was mailed via normal USPS means. At the end of the business day on the XXXX, we noticed that the XXXX software was not operating as it should. On XX/XX/2021 we called the XXXX and spoke with XXXX again. When we explained to XXXX that there were issues with Quickbooks we once again requested remote access. Once access was gained XXXX looked through various files and then using our computer, he displayed a map of the world with apparent tracer lines that he claimed was XXXX addresses that were being bounced through out the world but led to a XXXX gentleman. He even flashed an XXXX photo of a XXXX gentleman and claimed that we had been hacked. This seemed frightening at first but did draw scrutiny as it did not seem plausible that XXXX could use our computer to do such a trace. We ended the remote session and did a XXXX search for XXXX official site to locate a phone number. We dialed the number and was connected to a XXXX. 

We explained the situation with XXXX and XXXX said he had no record of our interactions with XXXX XXXX. We immediately stopped payment of the check sent to XXXX. XXXX asked for our software license number and provided us with a Customer ID of XXXX. He stated that Quickbooks does not call to solicit payments and that if some did call, they should be able to provide that customer ID if they are legit. XXXX explained that we could renew the software license for 5 years and stated it would cost {$5300.00}. He them gained access via Log Me In. he repaired the XXXX files. Payment was given via credit card over the phone and our XXXX XXXX was once again operating properly. XXXX left a Note Pad file with the Customer ID, toll free numbers XXXX and XXXX. He also provided us with an email of XXXX. The file also stated that the charges would appear on our next statement with the name XXXX. Out of an abundance of caution we contacted our CPA to ask if this seemed legitimate. The CPA did some research. On XX/XX/XXXX, the CPA initiated a three-way call with A XXXX team member. Upon review the XXXX team member provided us with a tech support phone number of XXXX and an account department number of XXXX. Upon further investigation, XXXX  stated that they could see no activity on our behalf. The XXXX team member then requested a screen view of where we located the number we called. When shown the method of a XXXX search and a result that stated XXXX Official site, the member stated that the site looked legit but the number we called was not in their database of numbers. In fact the number changed every time we closed the window and then accessed the site again. We called the credit card company to initiate a reversal of the payments and the XXXX team member advised us to file a report with the FBI. We immediately filed a dispute with Citi, the card which was used. On XX/XX/XXXX, we received a letter from Citi stating that they completed the investigation and closed the dispute. Citi stated that we accepted responsibility by providing the account number for the transaction and that the charges totaling {$5300.00} would remain on our account. This charge was made in a fraudulent transaction that is obviously a scam for service that would not be provided.