"EFT Wire Transfer" email about a $5,745.65 payment installs ScreenConnect remote access

A fake paid invoice email for $5,745.65 links to a remote-access program, not a PDF, and lists a number to call for a refund.

By the Xcelcor Guardian team · Reported October 5, 2026

Is it a scam?

Yes, it's a scam. No payment was made, and the "order information" link downloads a remote-access program that hands control of your computer to the sender.

Type

Email scam

First reported

October 1, 2026

Status

Still active

Who it targets

Anyone with an email address, including small businesses; the callback number uses a +1 (US) prefix

Tools it uses

ScreenConnect

If you got an email titled "EFT Wire Transfer" saying a payment of $5,745.65 was received, it's a scam. Nobody charged you. The "click here" link downloads a remote-access program that connects your computer to the scammer once it's opened. Don't click it and don't call the number in the email.

Researchers at the SANS Internet Storm Center described this email on October 1, 2026. So far it has been reported by them and by security news sites, not by a government agency.

What does the EFT Wire Transfer email look like?

The email is headed "Paid Invoice Receipt" and starts "Dear Customer". It says a payment of $5745.65 was received and asks you to click a link to see your order information as a PDF. Then it says that if you didn't authorize the charge, you should contact customer service to cancel and get an immediate refund. It lists a "Customer Support" number starting +1(332).

The copy SANS looked at showed the sender as contact@mejuri.com. Sender names and addresses are easy to fake, so a real company's name in the From line doesn't prove that company sent it.

What happens if you click the link?

The link doesn't open a PDF. It downloads a file called ScreenConnect.ClientSetup.exe. ScreenConnect is a real program that IT companies use to fix computers from a distance. This copy was set up in advance so that as soon as it runs, it connects your computer to the scammer's own ScreenConnect account. From there they can see your screen and take control of it.

Because the file is genuine, signed software, antivirus may not flag it. Many browsers now warn you before downloading a program like this. If you see that warning, stop there.

The phone number is a second trap. People worried about a $5,745 charge call it, and a "refund" conversation is a common way for scammers to talk someone into allowing remote access or reading out bank details.

I got the email but didn't click. What should I do?

Delete it. If you're worried about a real charge, check your bank or card account by typing the bank's web address yourself, or call the number on the back of your card. You can report the email at ReportFraud.ftc.gov.

I opened the file or called the number. What now?

Act now, one step at a time:

1. Disconnect the computer from the internet (unplug the cable or turn off Wi-Fi). This cuts the scammer off.
2. If you're on the phone with them, hang up.
3. Call your bank from another phone, using the number on the back of your card. Tell them someone may have had access to your computer.
4. Change your email password from a different device, then your banking passwords.
5. Remove the program. On Windows 11, go to Settings, then Apps, then Installed apps (on Windows 10 it's "Apps & features"), and uninstall anything named ScreenConnect that you didn't install yourself.

Follow our two-minute checklist for each step, and see what to do after a remote access scam for what to check in the days after. Report it at ReportFraud.ftc.gov and, if you lost money, at ic3.gov.

How to spot it next time

• A receipt for something you never bought, with a number to call to cancel, is a common setup. Real companies don't ask you to phone a number in a surprise invoice.
• A "PDF" that downloads a file ending in .exe is a program, not a document.
• The phone number in this email has too many digits for a real US number.
• If anyone on the phone asks you to install ScreenConnect, AnyDesk, TeamViewer or Quick Assist, hang up.

Our ScreenConnect scam guide explains more about how this tool gets misused.

Xcelcor Guardian adds a second check for moments like this. It's a Windows app that holds every new remote connection, including ScreenConnect, until the account holder approves it by email or on xcelcor.com. It isn't antivirus and won't remove a program that's already installed.

Last updated October 5, 2026