High riskBank & Payment

Refund Recovery Scam

In this scam, a caller claims you are owed a refund, gains remote access to your device, moves money between your own accounts to fake an overpayment, then pressures you to 'return' the difference to them.

Quick verdict

Risk level
High risk
Scam type
Remote-access refund deception
Main red flag
A refund call leads to remote access and a claim that you were overpaid by mistake.
What to do first
Hang up and disconnect; never give remote access or send money back.

What to know first

In this scam, a caller claims you are owed a refund, gains remote access to your device, moves money between your own accounts to fake an overpayment, then pressures you to 'return' the difference to them.

Bank and payment scams weaponise your trust in your bank and your fear of losing money. They fake fraud alerts, blocked payments, or refunds, then steer you into moving money to a "safe account", sharing a one-time code, or approving a transfer, actions a genuine bank will never ask of you.

The core pattern to watch for is clear: A refund call leads to remote access and a claim that you were overpaid by mistake. Hang up and disconnect; never give remote access or send money back.

Related tricks worth knowing: the Bitcoin ATM Payment Scam and the Geek Squad Renewal Email Scam. For the wider picture, browse the Bank & Payment Scams guides or run the message through our scam checker.

Scam statistics

#1
copycat bank fraud alerts were the most-reported text scam in the US in 2022
Source: US Federal Trade Commission
£459.7M
lost to authorised push payment (APP) fraud in the UK in 2023
Source: UK Finance

Tell-tale red flags

  • A call about a refund you were not expecting
  • A request to install remote-access software
  • A claim that you were 'accidentally overpaid'
  • Pressure to send the difference back urgently
  • Emotional manipulation to rush you

Staying safe

  • Hang up and do not grant remote access to anyone
  • Check your accounts yourself; the 'overpayment' is your own money moved around
  • Contact your bank using the number on your card
  • Report the attempt to your bank and authorities

How it usually reads

Example pattern, not a real report
Example pattern: 'We refunded you $5,000 by mistake instead of $500. Please log in while we watch and send back the extra $4,500, or I'll lose my job.'

This is a fictional, anonymised example used to illustrate the pattern. It is not a verified real message, and any names are used only to show how the scam typically reads.

What to notice: A refund call leads to remote access and a claim that you were overpaid by mistake.

Steps if you already acted

  • If you gave remote access, disconnect, remove the software, and run a scan
  • Contact your bank immediately to secure your accounts
  • Change online banking passwords from a trusted device
  • Watch for and report any unauthorised transfers

Common mistakes

  • Do not grant remote access for a 'refund'
  • Do not send money back from an 'overpayment'
  • Do not act on pressure or sob stories

Scams like this one

High risk Bank & Payment

Bitcoin ATM Payment Scam

This scam, often by impersonators claiming to be your bank, a government agency, or tech support, directs you to withdraw cash and deposit it into a Bitcoin ATM using a QR code they provide, sending the money irreversibly to the scammer.

Created by Scam or Safe Editorial Team
High risk Email

Geek Squad Renewal Email Scam

This scam emails a fake Geek Squad or tech-support 'renewal invoice' for a subscription you do not have, urging you to call a number where a fake agent talks you into refunds, remote access, or payments.

Created by Scam or Safe Editorial Team
High risk Bank & Payment

Bank Impersonation Phone Scam

In this scam a caller pretends to be your bank's fraud team, claims your account is under attack, and pressures you to move money to a 'safe account', read out one-time codes, or grant remote access so they can steal your funds.

Created by Scam or Safe Editorial Team

Your questions answered

How does the fake overpayment work?
With remote access, the scammer moves money between your own accounts so your balance looks higher, then claims they overpaid and asks you to send the difference, which is your own money.
Why do they want remote access?
It lets them control what you see and manipulate your accounts. No genuine refund requires remote access to your device.
I sent money back. What now?
Contact your bank immediately, change your banking password from a trusted device, remove any remote-access software, and report it.
How do I check a real refund?
Log in to your accounts yourself and contact the company or bank using official details, never a number or link from the caller.

Last reviewed June 2026 · Written & reviewed by the

Disclaimer: This page provides educational information only to help you recognise common scam patterns. It is not legal, financial, cybersecurity, or law enforcement advice, and it does not confirm whether any specific message, company, or person is genuine or fraudulent. When in doubt, contact the official organisation directly and report concerns to your local authorities.