'Refund Department' Screen-Share Bank Drain
A 'refund department' says you are owed money, has you log into your bank while screen-sharing, then fakes an overpayment and pressures you to send the 'extra' back.
Think a message like this reached you? You can check it right now.
What this scam is
You are told you qualify for a refund (a canceled subscription, an overcharge) and to install a screen-share tool so they can 'process' it. While watching your screen, they have you log into your bank, then manipulate what you see to make it look like they refunded far too much. They pressure you to return the 'difference' by wire, transfer, or gift cards. The refund is fake; you are sending your own money and exposing your accounts.
What it usually looks like
- A call or pop-up about a refund you are owed.
- A request to install screen-sharing software.
- Being guided to log into your bank while they watch.
- A claim they refunded too much and you must return it.
Common warning signs
- Any refund that requires screen-sharing or bank login together.
- A story about being overpaid and needing money back.
- Payment 'back' by wire, transfer, or gift cards.
- Pressure, secrecy, and staying on the line.
Example wording scammers use
“Your antivirus auto-renewed in error — we'll refund $399. Install this so we can process it on your account.”
“We accidentally sent $3,990 instead of $399. Please wire back the difference immediately.”
These are illustrative examples written by ScamSplain, not real messages.
What the scammers want
- Live access to your banking screen.
- You to send 'the difference' to them.
- To drain the account while you are confused.
What to do
- Never install screen-share software for a refund.
- Never log into your bank while someone watches or guides you.
- A real refund never requires you to send money back.
- Hang up and call your bank on the number on your card.
What to do if you already responded
- Call your bank's fraud line immediately and change online-banking credentials.
- Uninstall the screen-share tool and scan your device.
- Report to ic3.gov and reportfraud.ftc.gov.