Refund scam: what to do if they “overpaid” you
A message, email, or call says you were refunded too much. Maybe it is from a company you pay for a subscription, a “technician” who just fixed something on your computer, or a buyer who says they overpaid you. You check your bank app, and the money really is there, more than you were owed. Now they are polite, a little panicked, and asking you to send the difference back. It feels like the decent thing to do, and that is exactly how the scam works.
If you have already sent money, you did what almost anyone would do when handed a problem that looked like theirs to fix. Here is how it works and what to do next.
How the refund scam works
The money you see was never a gift or a mistake. In the most common version, the scammer convinces you to give them remote access to your computer or to log in to your bank “to process a refund.” Once they are looking at your screen, they move money between your own accounts, say from savings to checking, and make it look as though a larger refund arrived than they meant to send. Then they ask you to wire or send the “extra” back. The only real money in the story is yours, and the transfer back is what actually leaves your pocket.
A second version skips the remote access. A fake buyer pays with a check or payment that later bounces or is reversed, claims to have overpaid, and asks you to send back the difference before the original payment clears. Either way, the push is toward speed, secrecy, and a payment method that is difficult to undo.
What to do if you haven’t sent anything yet
Stop replying, and do not send, forward, or “return” anything. Look at your account directly, not through a link or number they supplied, and see whether the money truly arrived from outside or simply moved between your own accounts. If anyone had access to your computer, disconnect it from the internet, uninstall any remote tool they had you install, and read our guide on what to do if you gave a scammer remote access. Then call your bank using the number on the back of your card and tell them what happened, so they can watch for further transfers.
What to do if you already sent the difference
Call your bank right away, explain that you were tricked into sending money, and ask whether the transfer can be recalled. Speed matters most with wires and peer-to-peer apps, so the first hours are worth more than anything that comes later. Our guides on wiring money to a scammer and fake payment confirmations when you sell online cover the steps for each payment method, and preserving evidence in the first 24 hours explains what to save before anything disappears.
Also change the passwords on your banking and email accounts from a device you trust, and turn on two-step verification. If a scammer saw your login or your account balances, treat those credentials as exposed.
Report it
File a report with the FTC at ReportFraud.ftc.gov, and with IC3.gov if the money moved electronically. Reports are what let investigators connect one case to many, even when your own loss feels too small to matter. If the contact came through a marketplace or a payment app, report it there too.
Be wary of a second call
People who have been through a refund scam are often contacted again, sometimes by someone claiming to be from the bank or a fraud team who offers to get the money back. Real recovery help does not start with a stranger reaching out, and it never asks for access to your computer or a fee up front.
Wanting to correct what looked like someone’s mistake is a decent instinct, not a flaw. What went wrong here was the setup built around it. Checking, reporting, and telling the people close to you is the right way to close it out.
— Gus