The call or email sounds almost generous: a company you supposedly subscribed to is shutting down, or charged you in error, and they want to refund you. All you have to do is let them “process” it — and somehow that ends with money leaving your account instead. The refund scam flips a helpful gesture into a theft. Our GetMyPassword team explains how to recognize it.
How the scam works
Someone posing as tech support, an antivirus company, or a service you use contacts you about a refund you are “owed.” To deliver it, they ask to remote into your computer or have you log into your bank “to receive the transfer.” Then they fake a screen showing they refunded too much — say $5,000 instead of $500 — and beg you to return the difference, often by gift cards, wire, or crypto. No money ever came in; they manipulated what you saw. The “refund” you send back is your own real money, gone.
Red flags to watch for
- An unexpected refund offer for a service you may not even remember using.
- A request to remote into your device or to log into your bank while they watch.
- A claim they “accidentally over-refunded” and need the difference back.
- Repayment by gift card, wire or crypto — never how a real refund works.
- Pressure, panic and secrecy to keep you from pausing or asking your bank.
Why the over-refund trick works
Once a scammer has remote access or you are logged into your bank with them guiding you, they can move money between your own accounts or show a doctored balance to make it look like a big deposit landed. Seeing the “extra” money feels real, and most people genuinely want to return an honest mistake. That decency is the lever. But a legitimate company never needs remote access to your computer or your bank login to issue a refund, and never asks you to send money back in gift cards.
A real refund just appears in your account — it does not require you to log in while a stranger watches, or to mail gift cards back for an “overpayment.” The over-refund is a trick of the screen, not a transfer.
How to protect yourself
Never grant remote access for a refund, never log into your bank at a caller’s direction, and never repay an “over-refund” with gift cards, wire or crypto. Hang up and contact the company through its official number to check. If you let someone in, disconnect, run a security scan, and call your bank. Because these scams chase your logins, keep your accounts behind a unique password from our password generator and two-factor authentication.
Frequently asked questions
What is a refund scam?
It is a scam where someone posing as a company offers a refund, gets remote access to your device or bank login, fakes an “over-refund,” then pressures you to send the difference back by gift card, wire or crypto. No money was ever deposited.
How does a company really issue a refund?
A genuine refund simply appears back on your card or in your account. A real company never needs remote access to your computer, never has you log into your bank while they watch, and never asks you to return money in gift cards.
What should I do if I fell for a refund scam?
Disconnect any remote session, run a security scan, and contact your bank immediately to flag the transfers. Change your important passwords from a trusted device and enable two-factor authentication, and report the scam.