A refund scam claims you are owed money — for a cancelled subscription, an overcharge or a closing company. The victim is talked into granting remote access so the "refund" can be processed, shown a doctored account page implying they were overpaid, and asked to return the difference. Nothing was ever sent, and the returned money is real.
The refund scam is unusual in one respect: it does not ask you for money. It gives you some.
It begins with an unexpected credit. A subscription you do not remember has renewed and been cancelled, and a refund is due. An antivirus company is closing and returning customers’ balances. An overcharge has been identified. The number to call is right there on the invoice.
The person who answers needs to process the refund, and to do that they need to see your screen. Once they have it, something goes wrong: the refund has been entered incorrectly. Instead of $400, they sent $4,000. They will be fired. Would you return the difference?
You look at your account and the money is there. Except it never arrived. Either you are looking at a page the operator edited on your own screen, or they moved your own savings into your current account so that a balance genuinely changed. The refund is a picture. The money you send back is real, comes from your own funds, and goes on a rail that does not reverse.
Australia’s data captures how the pretext has grown: rebate scam reports fell 49.1% in 2025 while losses to the same category rose 170%, from A$1.7 million to A$4.7 million — a rise the National Anti-Scam Centre attributes to high-value cryptocurrency recovery scams using the same framing.
An invoice for a renewal you do not recognise, an email saying a company is closing and returning balances, or a call about an overcharge. Every version supplies a number to call.
Where it could have stopped
Never use a phone number supplied by the document that alarmed you. If you think a subscription may really have renewed, check your card statement or log into the provider directly. The invoice is the bait; the number is the trap.
As with tech support fraud, the inversion matters: defences built against cold callers do not fire on a number you dialled yourself.
A support tool is installed. It is presented as routine, and it hands over the browser, the files, the saved passwords and any banking session that is open.
You are asked to log into your bank so the refund can be confirmed. Then the “mistake” — $4,000 instead of $400. What you are shown is either an edited page or a genuine transfer between your own accounts. Nothing came from outside.
The agent will lose their job. Their manager is angry. They are apologetic and frightened. The request to return the difference is not a demand; it is an appeal, which is far harder to refuse.
Gift card codes read down the phone, a bank transfer, cryptocurrency, or cash to a courier. Any of these is final; a card refund would not be, which is exactly why none is offered.
Some victims are returned to repeatedly with new “errors”. Others are approached later by a recovery scam — the same refund logic, aimed at the loss the first scam created.
It reverses the direction of the ask. Every fraud warning people have absorbed is about someone wanting money from them. This one is about someone giving money and making a mistake. The frame does not match the warning, so the warning does not fire.
Guilt is a stronger lever than fear. The victim is not frightened; they are being decent. Keeping money that is not yours is wrong, the agent is in trouble, and returning it is straightforwardly the right thing to do. That is a much harder impulse to argue against than greed.
The evidence is on the victim’s own screen. Not a website they were sent to — their own bank account, in their own browser. Doubting it means doubting something people treat as ground truth, and almost nobody does under pressure.
Remote access removes the ability to check. Once someone else controls the display, what is on it is no longer evidence. Most people have never had to think about that distinction.
The urgency is human rather than institutional. Nobody threatens anything. Someone is going to lose their job because of an error made while helping you.
And the pretext scales. The same “we owe you money” framing works on a $400 subscription and on somebody who has just lost $400,000 to an investment fraud. Australia’s numbers show the operators moving it to wherever the value is.
Refund fraud is a variant of tech support fraud and shares its production base: organised call centres, with a large documented share aimed at North America run from India, and a domestic layer of couriers and mule accounts.
The overlap is visible in the case record. The Rhode Island prosecution described on this page charges eight defendants over a scheme in which pop-ups lured elderly victims into calling agents who then claimed their financial assets were at risk — around 300 identified victims across 37 states and more than $5 million in known losses. The refund story and the “your assets are at risk” story are two scripts running out of the same room.
The Australian data also shows something useful about disruption. Remote access scams fell on both measures in 2025 — reports down 47.8%, losses down 37.2% — which the National Anti-Scam Centre attributes to detection and disruption by banks and telecommunications companies. Rebate scams moved the opposite way. The same operators, facing pressure on one script, moved to another.
FBI Internet Crime Complaint Center data shows tech support fraud losses in the United States rising from $924.5 million in 2023 to $1.46 billion in 2024 and $2.13 billion in 2025 — a 131% increase in two years. Complaint volume grew far more slowly, from 37,560 to 47,794, meaning the average loss per complaint roughly doubled. Tech support is now the third-largest loss category the FBI tracks.
In May 2025 the US Attorney's Office for the District of Rhode Island indicted eight people over a transnational fraud and money laundering scheme aimed at elderly people in the United States and Canada. Pop-up messages on victims' computers made false claims that lured them into calling live agents, who then told them their financial assets were at risk or could be garnished. Investigators identified around 300 victims in at least 37 states with known losses exceeding million.
Australia's National Anti-Scam Centre recorded a 49.1% fall in rebate-scam reports to Scamwatch in 2025 while losses to the same category rose 170%, from A$1.7 million to A$4.7 million. The report attributes the increase to several high-value cryptocurrency recovery scams — the refund pretext being used against people who had already lost money once.
If someone is on your screen right now. Disconnect from the internet — unplug the cable or turn off Wi-Fi. That ends the session immediately. Do not argue, do not explain.
Then, using a different device:
If you sent money back.
Preventing it. One habit covers this whole family: never call a number that came with the thing that alarmed you. Not on an invoice, not in a pop-up, not in a text. If you think it might be real, go to the provider or your bank the way you normally would. That single rule closes the door before any of the rest of it can happen.
The returned “difference” is the victim’s own money, and it leaves on a rail chosen for finality. Gift card codes are resold within minutes of being read out. Bank transfers go to mule accounts and move on within hours. Cryptocurrency goes to an address the operation controls.
There is a detail worth noticing about the choice. A genuine overpayment would be corrected by the sender reversing it — no action needed from the recipient at all. The insistence that you send money back, by a method that cannot be undone, is the part of the story that makes no sense on inspection, and it is the part the emotional pressure exists to prevent you inspecting.
The other half of this story
Our sibling site Clean on Paper explains how the returned money is moved — the mule accounts, the gift-card resale market, and where the chain becomes visible to a bank.
No agency publishes a line item for most of the schemes on this site, so these charts show the official categories that contain this scheme. Each series is labelled with the agency's own category name. See how the mapping works.
It was not necessarily faked in your account — it was faked on your screen. With remote access, the operator can edit what the browser displays, or move money between your own savings and current accounts so a balance genuinely changes. Nothing arrived from outside; you were shown a picture, or your own money.
The overpayment is the entire mechanism. It creates an obligation — you have their money, and returning it is the decent thing to do. Your return payment is real, irreversible and comes from your own funds; the overpayment never existed.
No. The invoice is the bait and the number is the trap. If you think a real subscription might have renewed, check the account with the actual provider or look at your card statement. Never use contact details supplied by the document that alarmed you.
Sometimes, if you move today. Call your bank's fraud line immediately. Gift card issuers can occasionally freeze a balance if you call fast with the numbers. Cryptocurrency is much harder, but send the transaction hashes to the receiving exchange straight away.
Disconnect from the internet, then use a different device to change your email password first and banking second. Call your bank and say someone had remote access. Uninstall the software they installed and run a scan — and treat any account that was open during the session as compromised.
Increasingly, yes. Australia's National Anti-Scam Centre attributes a 170% rise in rebate-scam losses to high-value cryptocurrency recovery scams. The refund pretext is a wrapper: attached to a small overcharge it is worth a few hundred dollars, attached to someone who has just lost six figures it is worth far more.
Report it
Reporting is what produces the enforcement data on this page. Find the right agency and phone number for your country on the report page. If money moved in the last few hours, call your bank first.