Breaking down Refund Scams
A debt to be paid.
Refund scams can lead to big payoffs for scammers. The refund scam allows a scammer to look at a victim's bank balance and decide how much they can steal through manipulation. Because of this, they have become more common in recent years.
The goal of a refund scammer is to get access to a victim's banking page through computer software that allows them to see and take control of the computer. After they gain access and can see the bank account, they will try to convince the victim that there was an error and a much larger amount was refunded to the bank account and that this money needs to be returned.
Typically, refund scams start with a text, call, or email with something that will trigger the target to contact the scammer;
- A product has been ordered using your account, if you didn't place this order, contact us immediately.
- Suspicious activity has been detected on your account, contact us.
- A fake invoice sent to the target's email showing that a product or service was paid for.
- A service or software is no longer valid/active and the target is owed a refund.
Messages like this start building believability and trust to make the target easier to scam. No one wants to think they lost money for something they didn't purchase. Targets will then contact the scammer to dispute these charges or redeem their refund.
From Customer to Victim
Once the target falls for the story, it's time for the scammer to offer the refund. Scammers will likely convince the target that they need to connect to their computer so that their "secure refund server" can send the money to the target's bank account. They may ask the target to download software like TeamViewer, AnyDesk, LogMeInRescue, Splashtop, or others in order to connect to the PC just like in the Tech Support Scam scenario.
Once the scammer has made the connection via software, they will direct their victim to log into their banking page. They will further try to distract and build believability with the victim often by asking them to write down the current values of their bank account to check later on.
With the bank page on the screen, the scammer will take control of the PC and block the screen from view so a victim can't see what's going on. They will transfer money between the victim's accounts or alter the information shown through code on the website so that it appears a sum of money has been deposited into the victim's main bank account.
After hiding the banking page, they may show the victim a form to enter data on. This is often done with the Notepad app that comes installed on Windows. It may also be done with the command program which looks technical. They tell the victim that they must enter the information very carefully, in fact they often re-emphasize the need to be very careful about entering accurate information. They may ask for name, bank details, address, and other information.
Finally they will ask the victim to type in the refund amount they were told earlier by the scammer with a repeated emphasis on being careful. As the victim enters this amount, the scammer will quickly add zeros after and prevent the victim from making any changes by taking control of the PC again or 'submitting' the form by pressing enter quickly before the victim can get their bearings.
An example of this would be if a scammer told the victim that the refund would be $100 and then the amount entered shows $10,000 instead. The scammer will blame the victim for the error and act shocked and scared that such a large error has happened. They will say there is no way they can reverse it. Now they show the bank account again with the edited amount they made earlier. Of course this amount now looks like $10,000 has been added to the main account as if the refund has actually been received.
The scammer will now resort to anything to convince the victim that they made the mistake and must return the money immediately. They will often become abusive or pretend to be very sad. They may say things like they will lose their job, that the victim is a thief for intentionally trying to get more money or simply turn to plain abuse and threats. They may pretend to call a supervisor or manager to tell them about the mistake.
All of this is to gain the victim's sympathy for them or make the victim feel guilty or pressured for the mistake. They tell the victim that they are due their $9,900 that was sent in error (letting the victim keep their original refund amount of $100.) They will accept this money in various payment methods detailed on the Victim Support page.
I've already been scammed
If you want more information on payment methods and refund options or have already fallen victim to a refund scam, check our Victim Support page for advice on what to do next including emotional and mental support resources. You are not alone and there are people who want to help around the world.