Refund Scam Emails: How Scammers Trick You Into Paying More
The refund scam is one of the cruelest frauds because it starts by offering you money and ends with you losing money. A victim in Florida received an email from "Amazon" saying she was owed a $200 refund for a defective product she'd returned. She called the number in the email. The "Amazon representative" asked her to install remote access software so he could process the refund. Through screen manipulation, he made it look like $2,000 was deposited instead of $200. Then he begged her to send the $1,800 "overpayment" back via wire transfer. She sent it. No refund had ever existed. The $2,000 "deposit" was a transfer from her own savings account, moved on-screen while she watched.
How the Refund Scam Works Step by Step
Step 1: The bait. An email or pop-up announces you're owed a refund:
"You are eligible for a refund of $199.99 from [Company Name] due to an overpayment on your account. This refund has been pending for 30 days and will expire if not claimed. Call 1-800-XXX-XXXX to process your refund."
Step 2: The call. You call the number. A professional-sounding representative confirms your "refund" and asks you to install remote access software (AnyDesk, TeamViewer, UltraViewer) so they can process it "through your computer." They explain this is required for "security verification" or because refunds must be "processed from the original device."
Step 3: The overpayment illusion. With remote access, the scammer asks you to log into your bank account. They then ask you to close your eyes or look away while they "process the refund." During this time, they edit the bank's webpage HTML to show a larger deposit — $2,000 instead of $200. Or they transfer money from your savings account to your checking account, making it look like an external deposit.
Think it might be a scam?
Paste it here for a free, instant verdict.
Free · No signup required · Cmd+Enter to scan
Step 4: The guilt trip. The scammer returns, panicked: "Oh no, I made a terrible mistake. I entered $2,000 instead of $200. My supervisor is going to fire me. I could go to jail. Please, you have to send the extra $1,800 back. I'm begging you." The performance is designed to trigger sympathy. Some scammers pretend to cry.
Step 5: The extraction. You're directed to "return" the overpayment via wire transfer, gift cards, Zelle, or cryptocurrency. The scammer may even walk you through the process using the remote access they still have on your computer.
Why This Works Psychologically
The refund scam works because of reciprocity and honesty bias. When you believe someone accidentally gave you too much money, most honest people feel obligated to return the excess. The scammer weaponizes your honesty against you. The emotional manipulation — the panicked voice, the fear of job loss — activates empathy and overrides the analytical thinking that would reveal the scam.
The remote access element is critical. Seeing the "refund" appear in your own bank account — on your own computer — makes it feel real. Most people don't know that web pages can be edited client-side or that the numbers displayed in a browser don't necessarily reflect actual bank balances.
Brands Commonly Impersonated
Amazon, PayPal, Norton, McAfee, Geek Squad (Best Buy), and Microsoft are the most commonly impersonated brands in refund scams. The "refund" is typically framed as a subscription cancellation refund, a product return refund, or an overpayment correction. The specific brand doesn't matter — the scam follows the same steps regardless.
How to Recognize the Scam
Legitimate companies process refunds automatically. If you're owed a refund from Amazon, it appears on your credit card statement or in your Amazon account balance. Amazon never calls you, asks for remote access, or requires you to install software to receive a refund.
No legitimate company needs remote access to your computer to process a refund. This is a bright-line rule with zero exceptions. If someone asks to remotely access your computer for any financial transaction, it's a scam.
Refunds never involve you sending money. A refund is money coming to you. If at any point in a "refund" process you're asked to send money — via wire transfer, gift cards, Zelle, or any other method — it's a scam.
Check your actual account. Before engaging with any refund email, check your real bank statements and the actual website of the company in question. If a refund is truly owed, it will appear in your account or purchase history.
If You've Been Targeted
If you gave remote access to a scammer, disconnect from the internet immediately. Uninstall any remote access software they had you install. Change all banking passwords from a different, clean device. Call your bank and report unauthorized access. Run a comprehensive malware scan — scammers sometimes install additional backdoors while they have remote access.
If you sent money, contact your bank or the payment platform immediately. File a report with the FTC and your local police. The sooner you act, the higher the chance of recovering funds — though recovery rates for wire transfers and gift card payments are unfortunately low.
Received something suspicious? Check it now for free →