High riskBank & Payment Scams

Refund Recovery Scam

In this scam, a caller claims you are owed a refund, gains remote access to your device, moves money between your own accounts to fake an overpayment, then pressures you to 'return' the difference to them.

Quick verdict

Risk level
High risk
Scam type
Remote-access refund deception
Main red flag
A refund call leads to remote access and a claim that you were overpaid by mistake.
What to do first
Hang up and disconnect; never give remote access or send money back.

What this scam usually looks like

In this scam, a caller claims you are owed a refund, gains remote access to your device, moves money between your own accounts to fake an overpayment, then pressures you to 'return' the difference to them.

Example message pattern

Example pattern — not a real report
Example pattern: 'We refunded you $5,000 by mistake instead of $500. Please log in while we watch and send back the extra $4,500, or I'll lose my job.'

This is a fictional, anonymised example used to illustrate the pattern. It is not a verified real message, and any names are used only to show how the scam typically reads.

Red flags to watch for

  • A call about a refund you were not expecting
  • A request to install remote-access software
  • A claim that you were 'accidentally overpaid'
  • Pressure to send the difference back urgently
  • Emotional manipulation to rush you

What to do

  • Hang up and do not grant remote access to anyone
  • Check your accounts yourself; the 'overpayment' is your own money moved around
  • Contact your bank using the number on your card
  • Report the attempt to your bank and authorities

If you already clicked or replied

  • If you gave remote access, disconnect, remove the software, and run a scan
  • Contact your bank immediately to secure your accounts
  • Change online banking passwords from a trusted device
  • Watch for and report any unauthorised transfers

What not to do

  • Do not grant remote access for a 'refund'
  • Do not send money back from an 'overpayment'
  • Do not act on pressure or sob stories

Similar scams

High risk Bank & Payment

Bitcoin ATM Payment Scam

This scam, often by impersonators claiming to be your bank, a government agency, or tech support, directs you to withdraw cash and deposit it into a Bitcoin ATM using a QR code they provide, sending the money irreversibly to the scammer.
High risk Email

Geek Squad Renewal Email Scam

This scam emails a fake Geek Squad or tech-support 'renewal invoice' for a subscription you do not have, urging you to call a number where a fake agent talks you into refunds, remote access, or payments.
High risk Bank & Payment

Bank Impersonation Phone Scam

In this scam a caller pretends to be your bank's fraud team, claims your account is under attack, and pressures you to move money to a 'safe account', read out one-time codes, or grant remote access so they can steal your funds.

Frequently asked questions

How does the fake overpayment work?
With remote access, the scammer moves money between your own accounts so your balance looks higher, then claims they overpaid and asks you to send the difference, which is your own money.
Why do they want remote access?
It lets them control what you see and manipulate your accounts. No genuine refund requires remote access to your device.
I sent money back. What now?
Contact your bank immediately, change your banking password from a trusted device, remove any remote-access software, and report it.
How do I check a real refund?
Log in to your accounts yourself and contact the company or bank using official details, never a number or link from the caller.

Last reviewed: June 2026

Disclaimer: This page provides educational information only to help you recognise common scam patterns. It is not legal, financial, cybersecurity, or law enforcement advice, and it does not confirm whether any specific message, company, or person is genuine or fraudulent. When in doubt, contact the official organisation directly and report concerns to your local authorities.