The message looks urgent and almost boring: Amazon, PayPal, Geek Squad or your antivirus “overcharged” you, or someone used your account. Call this number. Cancel. Get a refund. That opening is one of the most reported business-impersonation patterns in US consumer complaints — the Federal Trade Commission (FTC) has repeatedly flagged Amazon lookalikes and tech-support refund theatre. The money step that follows is where the story turns ugly.
Legitimate Amazon or PayPal support does not cold-call you into installing remote-control software. Consumer agencies and Amazon’s own help pages are blunt: nobody from those brands needs TeamViewer, AnyDesk or similar tools to “process a refund,” and gift cards or cash mailed to a stranger are never part of a real fix. If you called a number from an unexpected email or text, you are probably already talking to the wrong desk.
What the caller wants next is control of the screen. They walk you through downloading remote-access software, then “show” a huge refund that never existed — sometimes by moving your own money between accounts while they watch, so a balance looks newly swollen. The US Cybersecurity and Infrastructure Security Agency (CISA) has described refund campaigns that abused legitimate remote-monitoring tools in exactly this way: phishing or a callback, portable AnyDesk or ScreenConnect, a faked overpayment, then instructions to “send the excess back.” The excess was yours.
When banks and money-transfer firms made wire pickups harder, the cash path mutated. Victims are told to withdraw notes, wrap them, and post or hand them to a “courier,” “compliance officer” or “agent” in their own country. That person is a money mule — someone who moves other people’s stolen funds for a cut. Europol’s public money-muling briefings describe how recruiters find mules through fake jobs, social posts and messaging apps; once cash is in the mule’s hands it often goes into a Bitcoin ATM (BTM) or another hard-to-reverse channel. The FTC’s 2024 consumer alert on Bitcoin ATMs matches the same pressure story: something is “wrong” with your account, so withdraw cash and feed a machine that credits a wallet you do not control.
A short check beats a long recovery. Hang up. Open Amazon, PayPal or your bank through the app or website you already trust — not through the message. Never grant remote access to someone who contacted you first. Never withdraw cash, buy gift cards, or post notes because a stranger on a refund call said you were “overpaid.” If a side hustle’s only job is receiving packages or feeding a crypto machine for someone else, walk away; that is mule work, not payroll — see our explainer on what a money mule is.
If you already installed remote software, disconnect the session, turn off the machine’s network, run a malware scan from a clean device, and tell your bank the same day. Keep the phone number, the email headers, screenshots of the chat and any tracking numbers. Start at Get help. Anyone who then offers to “recover” the cash for an upfront fee is usually a second scam — Fake recovery.
This article is for general information only. It is not legal or financial advice. Details change. If you have lost money, contact your bank or card issuer and use the routes on the help pages.