Author: Alan B. Densky
How a routine firearms training inquiry led to unauthorized computer access and fraudulent gift card purchases.
If you are a firearms instructor, the two messages below may look completely ordinary. That is the point. They looked like the kind of inquiries instructors hope to receive: a couple of beginners asking for safe, professional firearms training. One came through ShootingClasses.com. The other came directly to me two days later. I responded to the second one, and that decision eventually led to unauthorized access to my computers, fraudulent Amazon gift card purchases, and two exhausting days of cleanup.
I am publishing the messages because the wording matters. A scam does not always announce itself with misspellings, threats or an unbelievable promise. Sometimes it sounds exactly like a prospective student.
The First Message
On September 22, 2026, a message submitted under the name Peter Pius arrived through ShootingClasses.com. The inquiry read:
"Hello there, My spouse and I are located in FL and we are interested in learning the fundamentals of responsible firearm ownership and safe handling. We are both beginners and would like to find a qualified and certified firearms instructor who can provide training covering firearm safety, proper handling, storage, range safety, and basic shooting fundamentals. We are looking for a professional, safety-focused instructor and would appreciate any information about your training programs. Thank you and we look forward to hearing from you."
At some point before my computer problem, Bruce at ShootingClasses.com had sent out a warning. I not know how I missed it, but I did. Looking back, that warning matters because the first approach I had already come through a channel that instructors reasonably use to meet perspective students.
The Second Message
On September 24, 2026, a direct email arrived under the name Michelle Laura with the subject line Firearms beginners safety training inquiry. It said:
"Hello. My spouse and I are located in The villages, FL and we are interested in learning the fundamentals of responsible firearm ownership and safe handling.
We are both beginners and would like to find a qualified and certified firearms instructor who can provide training covering firearm safety, proper handling, storage, range safety, and basic shooting fundamentals.
We are looking for a professional, safety-focused instructor and would appreciate any information about your training programs.
Thank you, and we look forward to hearing form you."
That is the message I answered. At the time, I saw a believable training inquiry from two beginners in The Villages. The wording was nearly identical to the earlier message, but I did not connect the two.
The names above are the names displayed in the messages. I cannot say whether they belong to real people, were borrowed, or were invented by whoever sent the messages. I have omitted the displayed email addresses and telephone number from this article.
From a Student Inquiry to a Supposed Video Interview
The contact eventually shifted from an ordinary request for firearms training to what I understood would be a video interview. I believed someone wanted to interview me on video. Instead, I was socially engineered into allowing access that I never would have knowingly granted to a stranger.
They sent me an email containing what appeared to be a Zoom meeting link. When I clicked it, I was taken to a webpage that looked exactly like Zoom. The page said I did not have the newest version, and it automatically downloaded an installer into my Downloads folder. Then it just sat there.
So, me being ever helpful, I double-clicked the installer. That was all it took. When I returned to their meeting-invitation link, it took me back to the same webpage. There was still no actual invitation or place to enter the meeting.
A few minutes later, the people on the other end suggested that I try another computer. I did, with the same result. Then they wrote back and advised me to try it on my cellphone. That was when I had finally had enough. I answered their email and said no, I was not going to do that; we should simply conduct the interview by telephone. That was when they stopped answering my emails, and I became suspicious.
That transition is the lesson I want other instructors and small-business owners to remember. The first message does not have to ask for remote access. It only has to begin a believable relationship. Once you are engaged, the person can introduce a video platform, a technical problem, and download , or an offer to help you connect.
The Attackers Went Straight to Amazon
After access was gained, the attackers immediately targeted my Amazon account and purchased gift cards. A routine business response had turned into account fraud and a computer-security emergency. What followed consumed roughly two days: protecting accounts, changing passwords, inspecting two Windows computers removing unauthorized software and remnants, rebooting while offline, checking whether anything returned, and running full antivirus scans.
What We Found on Two Computers
The most important discovery was an unauthorized installation of ScreenConnect on two Windows PCs. ScreenConnect, also associated with ConnectWise, is legitimate commercial remote-support software. IT departments use it every day. The problem was not the product's name; the problem was that I had not authorized the installation.
It was installed as a Windows service, was running in the background, and was configured to start automatically with Windows. Its configuration referenced this relay address: relay.doublecaller.it.com
We also found remnants associated wth Splashtop and Atera, which are likewise remote-management products when authorized. After cleanup, both computers were restarted while disconnected from the Internet and inspected again. The removed items did not regenerate. AVG later reported no malware found. That result was reassuring, but it did not change the fact that unauthorized remote-access software had been present. Legitimate support tools are not necessarily detected as malware.
The Warning Signs I Missed
- Two supposed prospective students used nearly identical wording within two days.
- A straightforward training inquiry evolved into a video interview and technical instructions.
- The interaction reached the point where software or remote computer access became involved.
- A prior warning from ShootingClasses.com did not register with me before I responded.
None of those facts means every similar inquiry is fraudulent. Couples really do look for beginner firearms training, and legitimate interviews happen. The danger is the combination: repeated wording, a changing purpose, and pressure to install something or surrender control of a computer,
What to do if You Received Something Similar
- Compare the wording with the two messages in this article. Search your inbox for distinctive phrases.
- If the sender asked you to install software, joined an unusual video session, or permit remote control, stop and verify the person independently.
- If you believe access was obtained, disconnect the computer from Ethernet and Wi-Fi.
- From another trusted device, protect your primary email, shopping and payment accounts, financial accounts, website administration, and password manager. Enable multi-factor authentication.
- Document unfamiliar services, programs, paths, and antivirus exceptions before removing anything.
- Contact a qualified computer technician or incident-response professional if you are uncertain. Do not blindly copy removal commands written for somebody else's computer.
Legitimate Software Can Still be Used Against You
ScreenConnect or ConnectWise, Splashtop, Atera, AnyDesk, TeamViewer, LogMeIn, or GoTo, RustDesk, RemotePC, Ninja, DWAgent, and similar programs are not automatically malware. They have legitimate business uses. The important question is whether you or your trusted IT provider intentionally installed and authorized the software.
If you find an unfamiliar remote-access product, do not destroy evidence or delete random Windows files. Disconnect the computer, record what you found, and get competent help. The separate Windows inspection guide distributed with this article contains read-only checks and explains what the results mean.
Why I am Telling This Story
I do have evidence that firearms instructors as a group are being specifically targeted, since Bruce at ShootingClasses.com told me had had several similar complaints, so he put out his own warning. I am also saying that instructors and other small-business owners are reachable through ordinary business activities. We answer inquiries, schedule students, participate in interviews, manage websites, and accept payments online. A criminal can use that normal openness against us.
I would rather admit that I was fooled than stay quiet and let the same approach work on someone else. If these messages look familiar, take a few minutes to check what happened next on your computer. If this article prevents one unauthorized purchase or keeps one instructor from granting access, then something useful will have come from an experience I would not wish on anyone.
Important Disclaimer
This article and the accompanying guide describe what we found and what worked for us on two specific computers. Every system and installation can be different. This is educational information, not a guarantee that a computer is safe and not a substitute for professional technical, legal, financial, or incident-response assistance. If you are uncertain about a result or about removing anything, leave the computer disconnected and contact a qualified computer technician.
About the Author
Alan B. Densky is the owner of CCW Instructor, LLC, doing business as CCW Training Academy, and operated CCWInstructor.com. He is a firearms instructor who teaches safe, responsible firearm ownership and shares practical information intended to help students and fellow instructors make informed decisions.
Share this post:
