The tech-support refund scam: why the "overpayment" you see is a trick
A "refund" call gets you to log into your bank, fakes an overpayment, then pressures you to send the "extra" back. The money you see is your own. Here is how the scam works and the free move that stops it.
The tech-support refund scam is a sequel — it often targets people who fell for an earlier “your computer is infected” scam. This time the pretext is good news: you’re owed a refund. To “process” it, the scammer needs into your computer and your bank — and from there, they manufacture a problem only you can fix by sending them money.
How the scam works
The script is built to make you the one who moves the money:
- The refund pretext. An unsolicited call, email, or pop-up says a subscription is closing or you were overcharged, and a refund is owed.
- The remote access. You’re walked through installing remote-access software and logging into your online bank “so they can process the refund” — handing them a live view of your session.
- The fake overpayment. While in control, they move money between your own accounts (or alter the on-screen balance), then claim they accidentally sent far too much.
- The repayment. They pressure you — often saying the mistake will cost them their job — to send the difference back by wire, gift card, cash, or crypto. That’s your real money, gone.
The fact to remember: the “extra” money is never real. A legitimate refund is never fixed by you wiring cash or buying gift cards to return an “overpayment”.
How to spot it
The tells are in the box below, but the short version is: an unsolicited “refund” + remote access or a bank login + “you got too much, send it back” = stop. Refunds don’t work by asking you to repay them.
What to do instead
You don’t need to buy anything to beat this — the free move comes first (see the defense box). The habit that defeats it is the Call-Back Rule: never trust the contact that reached you. Hang up and call the company on an official number, and never let an unsolicited caller into your computer or bank. The related pop-up version is covered in the tech-support pop-up scam; for more, see our defense moves and the 60-second quiz.
- An unsolicited contact about a refund asks you to install software or log into your bank while they watch.
- You're told a deposit was "too much" and you must send the extra back yourself, urgently.
- The "repayment" must go out by gift card, wire transfer, cash, or cryptocurrency.
- Never give remote access or your bank login to anyone who contacted you out of the blue. No real refund requires it.
- Know the trick: a real refund never requires you to repay an "overpayment" in gift cards, wire, or cash.
- Hang up, then call the company back on an official number — from its website, your statement, or the back of your card — not a number the caller gave you.
- The "extra money" you see is a display trick or your own funds moved between your own accounts. Log in separately, after all contact ends, to check.
The genius — and the cruelty — of this one is that it turns your own honesty against you. You see 'too much' money and your instinct is to do the right thing and return it. But the surplus was never real; it’s your own savings shuffled around to look like a deposit. So the rule I’d hand a relative is simple: nobody you didn’t call gets to watch your screen or touch your bank login. Ever.
Sources
Frequently asked
A company says it deposited too much and wants me to send it back. Is that real?
No. This is the core of the refund/overpayment scam. Scammers fake an over-deposit — often by shuffling your own money between your accounts — so the money you "send back" is actually yours. Legitimate businesses do not handle a refund error this way.
I gave someone remote access. What do I do now?
Disconnect from the internet and close the remote-access software, then have the device checked or run a security scan. Call your bank and card companies on official numbers, change passwords from a clean device, turn on two-factor authentication, and ask the bank about reversing any transfers. Report it at IC3.gov.
Why would the refund "overpayment" show up in my account?
Because the scammer, while logged into your account through remote access, moves money among your own accounts (checking, savings) or alters what's shown on screen. No outside money arrived — they engineered the appearance to pressure you into sending real money out.