Fake Subscription Refund Callback Scam

This scam disguises a theft attempt as good news: an unexpected refund. Rather than demanding money outright, it opens with the promise of receiving some, which lowers the target's guard far more effectively than a threat would. The pretext is almost always a subscription — streaming, antivirus, cloud storage, a magazine, or a similar recurring service — because these are common enough that an overcharge sounds plausible to almost anyone.

The scam typically escalates from a simple refund claim into either remote access to the target's device and bank account, or a staged 'overpayment' that the target is pressured to return. Both paths end the same way: money leaves the target's account and is very difficult to recover, while no genuine refund was ever processed.

This scheme is closely related to broader tech-support and overpayment scams but is specifically packaged around subscription billing, making it distinct from generic 'you have a refund waiting' scams because it references a plausible, recognisable recurring charge.

The approach begins with an email, text, or robocall stating that the recipient was charged twice, charged after cancelling, or overcharged for a subscription renewal, and providing a phone number or link to 'claim your refund.' The message often names a real, well-known service to increase credibility.

When the target calls or clicks through, the scammer asks for account or card details 'to confirm identity' and then requests that the target install a remote-desktop or screen-sharing application, claiming this is needed to process the refund directly. Once connected, the scammer either directs the target to open their online banking themselves while narrating false instructions, or takes control of the screen entirely.

The scammer then either transfers money out of the account while pretending to be issuing a refund, or manipulates an on-screen number to make it look as though far more than the promised refund has been deposited. The target is told this was an error and is pressured, sometimes with a fabricated story about the representative being penalised, to immediately send the 'excess' back through a wire transfer, gift cards, or a cryptocurrency payment. In reality, no refund occurred; only the target's own money moved, or nothing was ever transferred and the balance shown was falsified.

The promise of a refund reframes the interaction as being in the target's favour, which lowers defensive instincts that would normally trigger around a stranger asking for remote access to a device or bank account. The fabricated urgency around an 'accidental overpayment' and the suggestion that an employee could get in trouble adds emotional pressure and time pressure simultaneously, pushing the target to act before pausing to verify anything independently.

A target receives an email or text stating they were mistakenly overcharged for a subscription renewal and are due a refund, along with a phone number to call. When the target calls, a calm representative confirms the overcharge and, to 'process the refund quickly', asks the target to install a remote-access application so they can 'verify the account.' Once connected, the representative navigates to the target's online banking, types a refund amount into the transfer field rather than a genuine refund system, and deliberately enters a much larger figure than agreed. The representative then claims the refund was sent in error and asks the target to return the difference by gift card or wire transfer immediately, framing any delay as risking disciplinary action against the 'employee' who processed it.

We detected a duplicate charge on your [Service] subscription. You are owed a refund of [amount]. Call [number] to claim it.

Your recent renewal was processed twice in error. Please contact our refund department at [number] within 24 hours.

Refund confirmation: [amount] will be returned to your account. To complete verification, please call [number] now.

Our system shows we accidentally sent you [larger amount] instead of [amount]. Please return the difference via [payment method] today.

Hang up and contact the subscription provider using a phone number or app found independently — never one provided in the refund message. Never install remote-access software at the request of someone who called or emailed unprompted, and never allow anyone you did not contact first to view or control your online banking session. A legitimate refund is issued directly to the original payment method without requiring you to log into your bank while someone watches or controls your screen.