S.M.M.

Stop Manipulating Me · A Field Guide to Psychological Influence

ENTRY No. T24.18
CATEGORY Internet Scams
CLEARANCE Public / Essential
EDITION 01
Dossier · Manipulation Tactic

Refund / Chargeback Scams

Transaction Fraud · Overpayment Ruse · High
High Alert
How It WorksSEC 01

Refund / chargeback scams invert the usual direction of fraud. Instead of asking you to pay for something, the scammer stages a scenario in which you appear to owe them — by “returning” an overpayment you never actually received. Because you believe extra money arrived and that giving it back is the honest thing to do, the con weaponizes your own integrity.

The classic form opens with a bait contact — a fake subscription-renewal or antivirus charge, or an unsolicited “your refund is ready” message — that lures you onto a call or chat. The “agent” offers to process a refund, then either takes remote access to your device or walks you through your online banking and displays a manufactured over-refund: a doctored screen, a transfer of your own money between your accounts dressed up as an inbound deposit, or a check that will later bounce. Then comes the line: “we accidentally refunded you $10,000 instead of $100 — my job is on the line, please send back the difference,” paid in gift cards, wire, or cryptocurrency.

A parasitic “refund-recovery” variant targets people who were already defrauded, posing as a recovery service, government fund, or the original bank offering to “get your money back” for an upfront fee. The recognition constant across all forms: an unexpected claim that money is owed back to you, pressure to move funds fast through irreversible channels, and resistance to your independently checking your real balance.

Warning SignsSEC 02
  • "You were overpaid — send it back." Any unsolicited claim that a refund requires you to return money.
  • Irreversible repayment. Requests to repay via gift cards, wire, crypto, or cash — never how legitimate refunds work.
  • Remote access or a guided login. Pressure to let someone control your device, or to log into your bank while they watch.
  • A manufactured emergency. "I'll lose my job," "act now," "the window closes in an hour."
  • Screens you can't study. Doctored or fast-flashed account displays you're discouraged from examining, showing a refund larger than any real purchase.
  • An unsolicited "recovery" offer to someone who was previously scammed.
Frequently Paired WithSEC 03
  • Vishing · T14.8
    The voice channel it usually runs on
  • Tech-Support Scam · T24.3
    The common bait that opens the con
  • Reciprocity Exploitation · T11.18
    The felt duty to return an "overpayment"
  • Advance-Fee / Recovery Scams · Cat 24
    The double-dip second-scam variant
How the Scam UnfoldsSEC 04
  • Stage 01 · The Bait
    A fake "auto-renewal charge" or "your refund is ready" notice lures you into a call or chat with a helpful "refund agent."
  • Stage 02 · The Staged Over-Refund
    Via remote access or a guided login, a doctored screen shows far more money "returned" than any real transaction — often your own funds moved between accounts.
  • Stage 03 · The Send-Back
    Believing you must return the excess and pressured by a manufactured emergency, you wire, gift-card, or crypto the "difference" — which was never new money.
Counter-ProtocolSEC 05
Defense: Verify your real balance before you believe any refund.
  • Check independently. Confirm your actual balance through your own banking app or by calling the number on your card before trusting any overpayment or refund claim.
  • Treat "you were overpaid, send it back" as fraud. Legitimate businesses do not refund by mistake and then demand repayment in gift cards or crypto.
  • Never grant remote access, and never log into your bank while someone guides you. A transfer between your own accounts is not new money, and a check can bounce weeks later.
  • Hang up and re-contact the company through an official channel; wait for any deposit to fully clear before sending anything.
  • Report and act. Report to the FTC (reportfraud.ftc.gov) and IC3 (ic3.gov); if funds were sent, contact your bank or card issuer immediately. Be doubly wary of anyone promising to "recover" money you already lost.