$25.5 Million: The Fake Computer Problems Behind Restoro and Reimage

The Federal Trade Commission sent more than $25.5 million in refunds to consumers in March 2025 who had purchased computer repair services from tech support companies Restoro and Reimage, resolving allegations that the companies used fabricated error messages and exaggerated security warnings to frighten consumers into paying for unnecessary services.DOCUMENTED

The refund distribution included more than 735,000 PayPal payments alongside mailed checks, reaching a substantial share of the consumers the FTC determined were affected by the scheme.DOCUMENTED

The scan that was designed to scare

According to the FTC's underlying allegations, Restoro and Reimage marketed free diagnostic scanning tools that consumers could download and run on their own computers, ostensibly to check for performance problems, security vulnerabilities, or system errors. The scans, the FTC alleged, were designed to return alarming results regardless of a computer's actual condition, generating warnings about supposed errors, registry problems, or security risks that were fabricated or significantly exaggerated relative to the machine's real state.DOCUMENTED

Having been presented with these frightening, and largely manufactured, diagnostic results, consumers were then directed to purchase paid repair or optimization software from the same companies to address the supposed problems — problems that, in many cases, did not actually require the paid intervention being sold, or did not exist in the form described by the free scan at all.DOCUMENTED

A long-running category of consumer fraud

Fabricated or exaggerated computer-error warnings used to sell unnecessary repair services, sometimes referred to as "scareware," have been a recurring target of FTC enforcement for more than a decade, spanning both software-based scanning tools like those at issue in the Restoro and Reimage case and live telephone-based "tech support" scams in which callers falsely claim to detect an active virus or hacking attempt on a consumer's device. The common thread across these schemes is manufacturing a sense of urgency and technical alarm sufficient to override a consumer's normal skepticism about paying for a service they did not seek out.REVIEWED

Distributing the refunds

The FTC's March 2025 distribution reflects the agency's standard approach to consumer redress in cases of this scale: rather than relying solely on mailed paper checks, which can go undelivered or unclaimed at meaningfully higher rates, the agency incorporated PayPal as a parallel payment channel, issuing more than 735,000 individual PayPal payments alongside its traditional check-based distribution. This combined approach is intended to maximize the share of eligible consumers who successfully receive and redeem their share of a settlement fund.DOCUMENTED

As with other FTC redress actions, recipients were instructed to redeem or cash their payments within a limited window following distribution, and the agency reiterated its standard warning that no legitimate FTC refund process requires a consumer to pay money or provide financial account information in order to receive their payment.DOCUMENTED

Why the scale of this refund stands out

At more than $25.5 million, the Restoro and Reimage refund distribution ranks among the larger tech-support-related consumer redress actions the FTC completed in 2025, reflecting both the scale of the underlying scheme and the substantial number of individual consumers who purchased the companies' paid repair services after encountering the alarming free-scan results. The size of the distribution underscores how effective fear-based marketing tactics can be at scale, even when, as the FTC alleged here, the underlying technical problems being marketed against were substantially fabricated or exaggerated relative to any genuine issue with a consumer's device.

Because scareware schemes like the one alleged against Restoro and Reimage typically operate through free, widely downloaded scanning tools rather than a single point of sale, identifying the full population of affected consumers can be considerably more complex than in subscription-based cases with a clear billing record. The scale of this particular distribution, reaching well over 700,000 people through PayPal payments alone, suggests the underlying scanning tools reached a substantial share of consumers who use free computer-diagnostic software, a category that remains a persistent vector for this kind of fear-based marketing scheme across the broader tech-support industry.REVIEWED

Cybersecurity researchers have long flagged free diagnostic scanning tools distributed through online advertising as a persistent vector for this kind of fear-based marketing, given how difficult it can be for an average consumer to distinguish a legitimate system-health check from one specifically engineered to manufacture alarming results regardless of a computer's actual condition.REVIEWED

The FTC's continued pursuit of scareware-style cases, even as the broader tech-support scam landscape has shifted increasingly toward more sophisticated, real-time impersonation tactics involving fake pop-up warnings that connect consumers directly to live scam call centers, suggests regulators view the underlying deceptive-alarm playbook as durable across changing technical implementations, regardless of whether the specific mechanism is a downloadable scanning tool or a browser-based pop-up.REVIEWED

Consumer cybersecurity guidance continues to recommend that computer users treat any free scanning tool downloaded from an unfamiliar or heavily advertised source with skepticism, particularly when the resulting diagnostic report immediately directs the user toward a specific paid product sold by the same company that provided the free scan, a structural conflict of interest the FTC's allegations in this case describe as central to how the underlying scheme operated at scale.REVIEWED

Legitimate antivirus and system-optimization vendors typically distinguish themselves by clearly separating diagnostic findings from any subsequent sales pitch, and by making their actual detection methodology available for independent review, a transparency standard the FTC's allegations suggest the free scans at issue in this case did not meet.REVIEWED

Regulators continue to recommend that any consumer encountering an unsolicited or unusually alarming computer diagnostic result seek a second opinion from an independent, reputable technician before agreeing to purchase repair or optimization services from the same company that produced the original warning, since that structural conflict of interest is precisely what allegedly drove the underlying scheme in this case.REVIEWED

Have documents relevant to this story? Reach us through our tips channel.