Seriously you don't know?
They get the person to connect to the computer with remote desktop, or similar. Tell them have to process a refund. The refund requires the person to log into their bank account. The scammer edits the HTML or perhaps a terminal window to make it look like their refunded...