Wire pickups got harder. Gift-card stock got watched. So the script adapted. After the fake overcharge and the remote-access “refund,” the voice on the phone says the excess must go back in physical cash — sealed, tracked, handed to a driver who will “secure” it for the merchant or the bank. You are told not to write a return address, not to tell the teller why you withdrew, and not to open the package again. That is not how any real shop or regulator returns money.
The person who collects the parcel is often a money mule: someone recruited to move other people’s stolen funds for a cut, or sometimes another victim who believes they have a delivery job. Europol’s public money-muling briefings describe recruiters who find helpers through fake jobs, social posts and messaging apps. Once cash leaves your hands, reversing it is grim. Postal and law-enforcement agencies in several countries have warned about cash-in-mail and cash-handover variants tied to tech-support and refund impersonation.
No legitimate refund requires you to withdraw notes and post them to a stranger. If a “courier” is already outside with a tracking number from the caller, do not hand anything over — that meeting is part of the theft chain. Hang up, keep the packaging and any chat logs, and tell your bank and local police the same day. For what mule work looks like when it is dressed up as a side hustle, see What a money mule is.
Start at Get help. If someone later offers to retrieve the cash for an advance fee, read Fake recovery first.
This article is for general information only. It is not legal or financial advice. Details change. If you have lost money, contact your bank or card issuer and use the routes on the help pages.