Image courtesy Saksham Choudhary
Refund scams work similarly to the tech support scam, with the scammer trying to gain access to the target victim’s computer and banking information. The refund scam starts out with a phone call from someone telling the target victim that they work for a retail or tech company. The target victim will be asked if they just ordered a product from the company or if they want to continue using the company’s product. The target victim may also receive a text message pretending to be from a retailer asking if they just ordered an item from the retailer’s online store. If the target victim tells the scammer they didn’t order a product or want the product, the scammer will tell the target victim they will be issued or receive a refund. The amount of the refund the scammer will tell the target victim they are entitled to will vary between one to five hundred dollars.
How the Refund Scam Works
The refund scam begins with the scammer asking the target victim to download a software app that allows screen sharing and remote access to the target victim’s computer. Downloading the remote access app will allow the scammer to see and control the target victim’s computer. Once the target victim allows screen sharing remote access, the scammer will ask the target victim to log into their bank account. When the target victim logs into their bank account, the scammer is able to see the target victim’s bank account balance(s) and the amount they plan to scam from the target victim.
The scammer will not allow the target victim to see their computer screen at the beginning of the refund scam. When the screen comes back on, the target victim will see two command prompt lines asking for the target victim’s “Name” and “Amount of refund.” The target victim will be asked to enter their name and the amount of the refund they are expecting from the scammer at the command prompt’s “Name” and “Amount of refund” lines.
As the target victim is typing out the amount of the refund the scammer has told them they will be receiving, the scammer will type extra zeros in the amount and press enter using their remote access. The scammer will then ask the target victim in a panic voice “What did you do?”, “Look what you did?”, “You typed the wrong amount”, “We refunded the wrong amount of money to you?” or “I’m going to lose my job”. The scammer will ask the target victim to check their bank account to confirm the fake refund amount that was supposedly refunded to the target victim’s bank account.
As the target victim checks their bank accounts, the scammer will once again not allow the target victim to see their computer screen so that the scammer can change the html code in the internet browser window to show the fake refund amount with the extra zeros. The target victim is often asked to purchase several retail gift cards for the difference between the refund amount the target victim was told they would be receiving and the amount of the fake refund amount the scammer said was refunded to the target victim’s bank account after the scammer changed the html code to show the fake bank account balance.
The scammer will also prep the target victim with what they should say if a retail employee asks why they are buying the gift cards. Once the target victim has bought the gift cards, the target victim will be instructed to give the gift card numbers to the scammer.
The scammer may ask the target victim to write a check or withdraw cash to send to an accomplice in another state who will launder the money back to the scammer.
An Example of the Refund Scam
For example, the scammer told a target victim they were entitled to a fake $100 refund. During the command prompt section of the scam, the scammer entered “10,000” on the command line by typing two extra zeros on the command prompt line. After adding the two extra zeros to the “Amount of refund” command prompt, the scammer changed the html code in the bank account browser window to read “$10,000 transfer from Tech Company.” The scammer will tell the target victim in this example to buy several retail gift cards totaling $9,900 in multiple gift cards of $500 amounts.
Preventing Refund Scams
Never allow anyone access to your computer or other device unless you contacted a company’s tech support yourself. Allowing a scammer remote access to your computer will allow the scammer to delete files, place a keylogger, virus, ransomware or malware on your computer, or even lock you out of your computer or other device.
Never give out your bank account, debit or credit card information.
Contact your financial institution to report the fraud or scam incident if you are a victim of a refund scam.
File a report with the Federal Trade Commission to report the refund scam fraud with the name the scammer used, phone number they called from, and other information.
