A refund scam is a fraudster posing as customer support or a vendor, claiming the victim is owed a refund, then engineering a fake overpayment so the victim sends money back or grants remote access to their account. It combines impersonation with remote-access tricks and often targets older victims, and no genuine refund ever requires you to send money back or share your screen.
What is a refund scam, in plain English?
A refund scam flips the usual con: instead of asking for money directly, the scammer claims to owe the victim money. Posing as a subscription service, a retailer, or a bank, they say a refund is due, perhaps because an account is closing or a charge was made in error. The victim, expecting a windfall, follows along, which is the moment the trap is set.
The core trick is a staged overpayment. The scammer pretends to send the refund but claims to have accidentally transferred far too much, often by showing a doctored account balance the victim sees on their own screen. They then plead for the difference to be returned. The victim, believing they received extra money, sends real funds back, while the original refund was never real.
To make the overpayment convincing, refund scams usually pair impersonation with remote access. The victim is talked into installing screen-sharing software so support can process the refund, giving the scammer control to manipulate what the victim sees and, sometimes, to operate their accounts directly. In the fraud stack, this overlaps heavily with tech-support and remote-access scams.
How a refund scam unfolds
- Contact — The refund notice. A call, email, or pop-up posing as support says the victim is owed a refund, often for a service they use.
- Access — Get onto the device. The victim is guided to install screen-sharing software so support can process the refund.
- Stage — Fake the overpayment. The scammer manipulates the displayed balance to show far too much was refunded by mistake.
- Extract — Get the money back. The victim is pressured to return the difference by transfer or gift card, sending real funds to the scammer.
What it looks like in practice
In practice
An older customer gets an email saying their antivirus subscription is auto-renewing and, since the service is shutting down, they are owed a refund. They call the number provided and are asked to install a remote-support tool so the agent can issue the money.
On screen, the agent appears to refund far more than expected, showing an inflated balance, and apologizes for fat-fingering the amount. Distressed and wanting to help, the customer transfers the supposed overpayment back. The refund never existed; the balance was faked through the remote session, and the returned transfer is the actual theft.
Why it matters for operators
Refund scams are effective because they invert the victim's guard. Someone braced against being asked for money relaxes when told they are owed some, and the staged overpayment adds urgency and guilt, pushing them to return funds quickly. Because the victim authorizes the transfer themselves, often from their own trusted device during a remote session, the payment can slip past device and location checks.
The strongest signals are the remote-access tool running during the session and the out-of-pattern transfer or gift-card purchase that follows, especially by an older customer sending money to an unfamiliar recipient. The message to reinforce is simple: no legitimate company refunds you by accident and then asks you to send money back, and none needs to control your screen to pay you.
What to watch for
- Unsolicited refund notices. An out-of-the-blue claim that the customer is owed money, often tied to a subscription or a closing service, is the hook.
- Screen-sharing installs. A request to install remote-support software to process a refund is a serious red flag.
- Staged overpayment. A story about accidentally refunding too much, followed by pressure to return the difference, defines the scam.
- Return by transfer or gift card. Being asked to send the overpayment back by bank transfer or gift card confirms the fraud.
- Vulnerable and rushed. Older customers making urgent, out-of-pattern transfers during a support call warrant intervention.
Quick questions
How does the fake overpayment work?
During a remote session, the scammer manipulates what the victim sees, showing an inflated account balance as if too much was refunded. The money was never actually sent, but the victim believes it was and returns the difference with real funds.
Why do scammers use remote-access software?
It lets them control the victim's screen to stage the overpayment and, in some cases, operate accounts directly. Because the activity comes from the victim's own trusted device, it can bypass device and location fraud checks.
Who is most often targeted?
Refund scams frequently target older people, who may be less familiar with remote-support tools and more trusting of official-sounding support callers. That said, anyone can be caught by a well-staged overpayment.
How is it different from a tech-support scam?
They overlap closely. A tech-support scam usually claims a device problem needing paid fixing, while a refund scam claims money is owed and uses an overpayment to reverse funds. Both rely on impersonation and remote access.
What is the simplest rule to spot it?
No real refund requires you to send money back or share your screen. If a supposed refund leads to a request to return an overpayment or install remote software, it is a scam.
How should a bank intervene?
Watch for remote-access sessions paired with out-of-pattern transfers or gift-card buys, pause the payment, and ask directly whether the customer was told they were owed a refund and asked to return money. That question often breaks the spell.
Go deeper
- FTC Consumer Advice: Scams ↗ — US consumer guidance on current scams and fraud, and how to report them.
- FBI IC3 ↗ — The FBI Internet Crime Complaint Center. Fraud reporting and annual trend reports.