Refund scam: the caller says they refunded you too much money
Why the "we refunded too much" money is your own, and what to do if you let the caller onto your computer.
If someone offered you a refund, got onto your computer, and now says they sent you too much and you have to send the difference back, it's a scam. No money came from them. What you saw on the screen was either your own money moved between your accounts, or a number they changed on the page. Don't send anything, hang up, and call your bank using the number on the back of your card.
How does the refund scam start?
It usually begins with an email, a text or a call about a charge you don't recognize. Common ones are a renewal for antivirus, a "Geek Squad" or "Best Buy" service plan, an Amazon order, or a computer support plan you're told is ending. The message gives a phone number to call if you want to cancel and get your money back.
Some people get the call out of the blue. The caller says the "computer support company" you paid years ago has gone out of business and you're owed a refund. People who were caught by a tech support scam before are often called again this way.
Either way, the caller says the refund has to be processed on your computer. They ask you to go to a website and install a program such as AnyDesk, TeamViewer, UltraViewer or Quick Assist, then read them a code. That gives them control of your screen.
Why do they say they refunded too much?
Once they're connected, they ask you to log in to your online banking "so you can see the refund arrive". Then they ask you to type the refund amount into a box. While you're typing, or while your screen is blank or covered, an extra zero appears. A $400 refund becomes $4,000.
The caller then acts upset. They may say they'll lose their job, and they ask you to send back the "extra" $3,600. They ask for it as gift cards, a wire transfer, cash in the mail, a Bitcoin machine, or a payment app like Zelle.
Here is what really happened. With control of your PC, the scammer can do one of two things:
- Move your own money from savings or a credit line into checking, so the checking balance goes up.
- Change the numbers shown on the bank's page in your browser. Nothing at the bank changes, but the page shows a big deposit.
Either way, there was never any refund. The money they want you to "return" is yours.
Is a "we refunded too much" call ever real?
No. A real company that makes a mistake on a refund doesn't need control of your computer, doesn't need you logged in to your bank while they watch, and never asks for gift cards or crypto. The FTC's advice is simple: if someone asks you to pay so you can get a refund, it's a scam.
If you aren't sure about a charge, look up the company yourself, or check the account on your own from your phone, with nobody else on the line.
I already let them on my computer. What do I do now?
Do these in order. It's fine if you can only do some of them today.
- Hang up. You don't owe them an explanation.
- Disconnect the PC from the internet. Unplug the network cable, or click the Wi-Fi icon at the bottom right of the screen and turn Wi-Fi off.
- Call your bank from another phone, using the number on the back of your card. Tell them a scammer had remote access while you were logged in. Ask them to check for money moved between your accounts and any new payees, and to put a hold on transfers.
- If you sent gift cards, call the company that sold the cards (the number is on the back of the card) and ask them to freeze the balance. Keep the cards and the receipts.
- From a different device, change the password for your email and then your bank.
Our two-minute checklist walks you through these same steps.
How do I get the remote access program off my PC?
Scammers often leave the program installed so they can come back later. On Windows 11:
- Open Settings (press the Windows key and I together).
- Go to Apps, then Installed apps. On Windows 10 it's Apps, then Apps & features.
- Look for AnyDesk, TeamViewer, UltraViewer, RustDesk, ScreenConnect or ConnectWise Control, or anything you don't remember installing on the day of the call.
- Click the three dots next to it and choose Uninstall.
Some of these programs run without being installed, straight from your Downloads folder. Open File Explorer, go to Downloads, and delete any file with those names. Then empty the Recycle Bin.
To check nothing is still running, press Ctrl + Shift + Esc to open Task Manager and look under Processes for the same names. If you're not sure the PC is clean, have a local repair shop you trust look at it before you use online banking on it again. Our guide on what to do after a remote access scam covers this in more detail.
Who do I report a refund scam to?
- The FTC at ReportFraud.ftc.gov.
- The FBI at ic3.gov, especially if you lost money.
- IdentityTheft.gov if you think they saw your Social Security number or other personal details.
- Microsoft at microsoft.com/reportascam if the caller said they were Microsoft.
Write down the phone number they called from, the number you called, the name they gave, and the program they had you install. Your bank and the police will ask for these.
Be careful of anyone who calls later saying they can help you get the money back. "Recovery" callers are often the same people, or people who bought your details from them.
If you want to stop this from happening again, Xcelcor Guardian is a Windows 11 app that holds every new remote connection, from AnyDesk, TeamViewer, Quick Assist and others, until you or someone you trust approves it by email. A caller who talks you into installing a program still can't get on without that approval. It works alongside your antivirus and doesn't see your screen or banking.
These calls are rehearsed and convincing, and they catch careful people. For more on how the wider scam works, see our guide to tech support scams.
Last updated