A caller says you are owed a refund. What is really going on?

The problem

The message sounds like good news. A caller or text says you are owed a refund, perhaps for a product that failed an inspection, a subscription charge you did not expect, or an overpayment. All you need to do, they say, is click a link, give some details or let them connect to your computer to process it.

The refund does not exist. What exists is a route to your bank account or your device.

How it can happen

The FTC has described several versions. In July 2025 it warned about texts that appear to come from Amazon and claim a "routine quality inspection" found a recent purchase failing standards or recalled. They offer a full refund without returning the item if you click a link. The link is a phishing attempt to steal money or personal information.

In another pattern, described in the FTC's Geek Squad alert, a text or email says you were or will be charged hundreds of dollars to renew a membership, and that you must call within 24 hours to dispute it. If you call, the scammer may ask for remote access to your computer, and with that access can install spyware or steal online banking credentials. Some then claim to refund you, fake an overpayment and ask you to buy gift cards and send the numbers and PINs.

The FTC's tech support guidance describes the common tools: remote access, a made-up problem and a request for payment by gift card, wire, cryptocurrency or payment app.

Our article on fake subscription renewal emails covers the first half of that script in more detail.

How to avoid it

1. Do not click or call. The FTC says not to use the number included in the message.
2. Check from your side. Log in to the company's website or app directly, and look at your orders and charges. A real refund or recall notice will be there.
3. Use a number you know. If you think the message might be real, contact the company using a phone number, email or website you already know is legitimate.
4. Never allow remote access for a refund. The FTC says legitimate companies do not contact you about computer problems, and the tech support page lists unsolicited requests for remote access as a red flag.
5. Never send money back. A claimed overpayment that you must repay by gift card is a standard scam step.
6. Report and delete. Forward the text to 7726 (SPAM), or use your phone's report junk option, and report at ReportFraud.ftc.gov.
7. Check your accounts. Look for unauthorised charges, and ask your bank or card issuer to reverse them if you find any.

Things to watch

• A refund you did not request.
• A deadline, such as ringing within 24 hours.
• A phone number inside the message.
• A request to open a link, install a program or share your screen.
• Any suggestion that you were overpaid and should buy gift cards to return the difference.
• Callers who say you must keep the matter private.

If you did allow access or pay, take the steps in what to do after you shared a code or gave someone access. For the connected topic of a caller asking to control your screen, read the remote access request.