Refund Scam

A refund scam uses the promise of money coming back to the victim as its lure. The pretext varies — an accidental overcharge, an expiring subscription, a service closing down, compensation for a previous fraud — but the mechanics converge: to "process the refund," the victim must hand over card details, grant remote access to their computer, or return an "overpayment" that never actually arrived.

How it works

The classic corporate-adjacent variant starts as callback phishing: an invoice lands by email for a subscription the victim never ordered — antivirus renewal, software license, support plan — with a phone number to call for cancellation and refund. On the call, a friendly agent walks the victim through installing a legitimate remote-access tool, then stages the fraud's centerpiece: a fake refund transfer. With access to the screen, the scammer edits the browser's displayed bank balance or shows a doctored confirmation, "accidentally" refunding far too much — $4,000 instead of $400. The victim, seeing the inflated number and feeling responsible, is pressured to return the difference by wire, gift cards, or cryptocurrency. No overpayment ever happened; the "returned" money is the victim's own, and the remote session often leaves credential stealers behind.

Other variants skip the theater: fake refund portals harvest card numbers and online-banking logins directly, and recovery scammers contact previous fraud victims posing as investigators who can claw back losses — for an upfront fee, making it advance-fee fraud in a sympathetic costume. Refund lures also reach employees at work, where "accounts payable was double-charged" pretexts aim at corporate cards and banking credentials.

How to defend against it

The reflex to teach: money you are owed never requires installing software, reading out codes, buying gift cards, or sending money first. Unexpected invoices get verified through the vendor's official site — never the phone number in the message, the same verification discipline that defeats fake IT-support calls. At the organizational level, block unapproved remote-access tools, route refund and billing disputes through documented finance channels, and include refund-bait scenarios in security awareness training, because the overpayment script succeeds through emotional pressure — guilt and urgency — rather than technical trickery.