Blog/Online scams

Refund Scams: "We Overpaid Your Refund"

A caller processes a refund, then claims they sent too much and need the difference back. How refund scams use remote access and edited screens to trick you into sending money.

CyberWatch AI29 September 2026 · 2 min read

A man working at a laptop on a desk by a sunny window

It starts with good news: you are due a refund. Maybe for an antivirus subscription you never renewed, an overcharge on your internet bill, or old tech support you paid for. A friendly agent helps you receive it. Then something goes wrong. They accidentally typed an extra zero, and now they will lose their job unless you send the difference back. You look at your bank balance, and it does seem to have gone up. It has not. This is a refund scam.

How the refund scam works

The hook: a fake renewal email, a call about an overcharge, or a follow-up from an earlier tech support scam. See fake subscription renewal scams.
Remote access: you are asked to install an app "to process the refund". See remote access app scams.
Online banking: you log in so they can "see the refund arrive".
The fake overpayment: they blank your screen, then either edit the web page to show extra money or move money from your savings into your current account.
The panic: they claim they sent 10 or 100 times too much, and plead or threaten.
The ask: send the difference back by transfer, gift cards or crypto.

If a "refund" has been overpaid, do not send anything back. Log out, close any remote access, and check your balances yourself from a device they have not touched.

Illustrative example · Phone call

"Oh no, sir, I typed 4,000 instead of 400! Look, your account shows it. My manager will fire me. Please, you have to send back 3,600. The bank transfer won't work because of security, so you'll need to buy gift cards. I'll stay on the line with you while you go to the store."

Red flags:

A dramatic "mistake" and emotional pressure.
A request to return money by gift cards.
Staying on the line to stop you thinking or checking.

Why it is convincing

You saw it on your screen. But the screen was under their control.
Kindness: people do not want someone to lose their job over a typo.
Guilt: keeping money that is not yours feels wrong.

How genuine refunds work

They are processed back to your original payment method.
They do not require remote access or you to log in while someone watches.
Errors are corrected by the company, not by you sending money.

If you have been caught

End the call and disconnect your device from the internet.
Call your bank on the number from your card to stop any payments and secure your accounts.
If you bought gift cards, contact the issuer immediately with the codes and receipts.
Remove the remote access app and follow what to do after giving a scammer remote access.
Report the scam; see how to report a scam.

Received a refund or renewal notice? Paste it into CyberWatch AI Scan for a free check.

Refund scams are a close cousin of overpayment scams. For the bigger picture of how online scams work, read our complete guide.

Frequently asked questions

How can they show money arriving in my account if it is fake?

With remote access, scammers can edit what your web page shows, or move money between your own accounts, such as from savings to current, so it looks like a refund arrived.

Would a company ask me to send back an overpaid refund by gift card or transfer?

No. Genuine companies correct refund errors through their own systems. A request to send money back by gift card, crypto or transfer is a scam.

I did not ask for a refund. Why did they call?

Refund scams often start with a fake renewal email or call about a subscription you never bought, precisely so you will want a 'refund'.