A fake Microsoft security warning led an elderly Wisconsin woman through nearly a month of gift-card purchases, Bitcoin transfers and cash handoffs that cost her $135,200.
Police arrested Tao Wu when he arrived at her home for another planned collection. Court records showed that Wu was not the person directing the calls because the caller contacted the woman again after Wu was already in custody.
Wu, 38, pleaded no contest to felony theft. A Marathon County judge sentenced him to 2½ years in prison and five years of extended supervision, with restitution to be determined at a later hearing.
The Pop-Up Claimed Her Computer Security Had Been Breached
The scheme began in October 2024 when a pop-up appeared on the woman’s computer claiming that her security had been compromised, according to WSAW.
She called the number displayed on the screen and reached a man who claimed to work for the “Microsoft Fraud Division” in Redmond, Washington. He provided an employee identification number and said someone had used her personal information to purchase $5,200 in pornographic material.
The caller then transferred her to another person presented as a member of her bank’s technical-support team. That person instructed her to duplicate the supposed transaction so it could be canceled. He claimed her money would remain protected on a “secure bank line” and would be returned after the disputed charge was removed.
A Secret Phrase Made the Fake Banking Line Sound Secure
The callers gave the woman the phrase “I love white horses,” which they said would confirm that she was communicating through a secure channel. For nearly a month, one caller contacted her daily with instructions about what to purchase or withdraw.
She believed the money was being moved into a protected escrow account and that she would be reimbursed for taxes and penalties associated with the transactions. The caller changed payment methods as the scheme continued, moving from gift cards to cryptocurrency and then to cash collected directly from the woman’s home.
The operation followed a pattern the FBI has described in tech-support and “phantom hacker” scams. One person poses as a technology-company employee before transferring the target to someone impersonating a bank or government representative.
Gift Cards, Bitcoin and Cash Totaled $135,200
The woman purchased approximately $9,200 in gift cards and read the card numbers to the caller. She also bought $56,000 in Bitcoin and transferred it as instructed.
In two separate exchanges at her home, she handed $25,000 and then $45,000 in cash to men who arrived to collect it. The four reported amounts totaled $135,200. Investigators said the transactions emptied her checking and savings accounts.
Police Waited for the Next Cash Pickup
The investigation began in November 2024 after the woman’s retirement company noticed suspicious activity and contacted her son. He reported the suspected fraud to law enforcement.
A witness who had observed one of the earlier cash exchanges gave investigators a physical description of the person involved. When the caller arranged another pickup for Nov. 18, officers waited at the woman’s home. Wu arrived and was taken into custody.
Court records clarified that Wu and the caller were different people. The person directing the scheme called the woman again after Wu had already been arrested.
Restitution Will Be Decided at a Later Hearing
Wu pleaded no contest in March 2026 to felony theft involving the scheme. Marathon County Circuit Judge Mike Moran sentenced him on July 20 to 2½ years in prison followed by five years of extended supervision.
The court credited Wu for time he had already spent in custody. A separate hearing will determine how much restitution he must pay toward the woman’s $135,200 loss.
Real Microsoft Warnings Do Not Include a Phone Number
Microsoft says its genuine error and security messages never include a telephone number. The company also says it does not make unsolicited calls asking for personal or financial information and will never demand payment through Bitcoin or gift cards.
A warning that displays a support number should be closed without calling it. If the browser will not close normally, Microsoft recommends using Alt-F4 or restarting the computer, then contacting support through Microsoft’s official website rather than through the pop-up.
The Federal Trade Commission says a caller who claims money must be moved to protect it is operating a scam. Banks, technology companies and government agencies do not tell customers to purchase gift cards, move savings into cryptocurrency or hand cash to a courier.
The FBI accepts reports through IC3.gov. People age 60 or older who need help filing a complaint can also contact the Justice Department’s National Elder Fraud Hotline at 833-372-8311.