The Refund Scam, Unmasked: The Script, the Money, and the Tells
the refund scam is a magic trick, and like every magic trick it is boring once you see the wires. there is no hacking. there is a remote-control session, a number typed into a box, and a bank balance that is quite literally an edited web page. the victim sends real money to fix a fake problem. here is the whole thing, lit from behind.
act one: the hook
it starts with a vague charge. a “renewal” for an antivirus you do not remember buying, a “refund” you are owed, a subscription about to auto-bill $499. the email or popup has a number. you call. that is the only hacking in the entire operation: they got you to dial.
act two: the remote session
the “agent” needs to “process your refund,” so they ask you to install a tool so they can “help.” it is a legitimate remote-support client, usually screenconnect or anydesk. we pulled one apart in the sandbox: the “refund form” is just a thin wrapper that connects to the operator’s relay.
once connected, they own the screen. they will often black it out “for security” so you cannot see what they are doing. what they are doing is setting up the con’s centerpiece.
act three: the overpayment
they ask you to log into your bank so they can “deposit the refund.” then they fumble: oops, they “accidentally” refunded $9,000 instead of $90. look, right there on your balance. you have to send back the difference or the poor agent will lose their job.
the extra money does not exist. with control of the screen, they edit what your browser shows: inspect-element on your own bank page, or an html overlay, changes the number. no funds moved. the balance is a <div>. a hard refresh would expose the whole thing, which is why they keep you panicked and off-balance and never let you close the tab.
act four: the money actually leaving
here is the only real transaction in the story, and it flows out of the victim: gift cards (read the codes over the phone, instantly drained and resold), a wire to a “mule” account, or crypto to a reused wallet. once gift card codes are spoken aloud, the money is gone. there is no chargeback on a drained steam card.
the tells, in order
- unsolicited contact with urgency. real companies do not cold-call to refund you, and they never need remote control of your computer to do it.
- “install this so i can help.” any request to install anydesk, teamviewer, screenconnect, or “our secure tool” from a cold call is the scam. full stop.
- the screen goes dark. legitimate support does not black out your screen.
- the “overpayment.” nobody refunds you too much by accident and then makes it your emergency. that beat exists only in this script.
- gift cards or wires to “return” money. no legitimate refund is ever fixed with gift cards. this is the kill switch tell.
what defenders and victims can do
- mid-call: hang up. that is allowed. you do not owe a scammer politeness. power the machine off the network if someone is connected.
- after: from a clean device, change passwords (email first), call the real bank on the card number, uninstall the remote tool, and watch for persistence (a leftover rmm service or run key).
- for families: the single most protective sentence you can teach an older relative is “nobody legitimate will ever ask you to buy gift cards.”
- for fraud teams: document the instance id, relay, and overpayment amount. it feeds the trace and the report (see the rest of this series).
sloth take
the refund scam survives because it never attacks the computer, it attacks the person, and people are not patchable. but the trick is dumb once you see it: a remote session, a fake number, an edited page, and a plea to send gift cards. say the tells out loud to the people you love before a call-center does.
want fraud-awareness training that does not put your staff to sleep, or an IR playbook for rmm abuse? Book Dark Edge Consulting.
sources
- FTC consumer guidance on tech-support and refund scams (consumer.ftc.gov)
- Cofense and industry reporting on ScreenConnect abuse in phishing campaigns
- FBI IC3 alerts on tech-support fraud and the overpayment variant
- Lab artifacts generated on-box 2026-10-17 (synthetic sample teardown and terminal captures)
