The theatre is designed to feel like a paperwork error. Someone claiming to be from Geek Squad, Amazon, PayPal or “bank fraud” already has remote access to your computer. They open a browser, tap through what looks like a merchant or bank portal, and a refund of several thousand appears. Then comes the apologetic voice: we sent too much; you must return the difference or your account will be frozen. Gift cards, a wire, cash in an envelope, crypto — anything hard to reverse.
Here is the part many people only learn later: the “extra” money was rarely a real merchant credit. Reported versions of this scam have the operator using the remote session to move funds between the victim’s own accounts, credit lines or payment apps, or to stage a fake page that only looks like a bank balance. What you see as an accidental windfall is often your savings reshuffled so the “send it back” step feels fair. The Cybersecurity and Infrastructure Security Agency (CISA) has outlined refund campaigns that abuse legitimate remote-monitoring tools in exactly this way — callback, portable remote software, a faked overpayment, then instructions to return the excess.
A real overpayment from a retailer does not require you to buy cards, withdraw notes, or stay on the phone while a stranger drives your mouse. Banks and shops reverse their own mistakes through their own channels. If a caller needs you to “fix” a balance by paying them, hang up and open the bank app yourself from the icon on your phone — not from a link they paste into chat.
If the session already happened, disconnect remote software, change passwords from a different device, and call the bank’s published fraud number. Ask them to review recent internal transfers as well as outbound payments. Keep screenshots of the fake refund page if you still have them. More on how this joins cash-mule and ATM steps is in Fake Amazon refunds, remote access, then cash or a Bitcoin ATM.
Report and get practical next steps at Get help. Treat cold “we can claw the money back for a fee” pitches as Fake recovery until proven otherwise.
This article is for general information only. It is not legal or financial advice. Details change. If you have lost money, contact your bank or card issuer and use the routes on the help pages.