$399 is going to be charged from your checking account or plastic card
The refund or Windows License Expired scam is a variation of the traditional phony technical support scam. In a traditional refund scam a target list of victims are hit with robocalls informing them that a tech support company is 'going out of the business' and that you were a subscriber who is due a refund. Because this type of scam script had become easier and easier to identify, refund scammers have switched to claiming that your computer's antivirus security subscription has expired and will ask you whether you want to cancel or renew the subscription.
Most victims will opt to cancel and from there the traditional refund scam script resumes where the scammer connects to your computer with GoToAssist or TeamViewer then asks you to login to your bank. From there they will try to blank your screen while they edit the HTML of your balance page at your bank to show a phony deposit from the scammer. The scammer will then inform you that they made an error and deposited too much money and ask you to transfer some of it back to them. Simply pressing F5/refreshing reveals the scam.
To bait this scam, use a virtual machine and carry out everything the scammer asks you to do slowly. You can use Northwatch as your fake bank. We also have a virtual machine you can use here.
Some helpful directory information about this number I found: