The refund that was $9,000 too generous.
A composite. This case is assembled from how this pattern is repeatedly reported to us and documented publicly — it is not the file of one identifiable person, and no detail here should be read as belonging to a real individual.
What happened
A retired teacher was called about a $89 refund for a subscription he had cancelled years earlier. To process it, the caller asked him to install a support app so they could “complete the form together”. While connected, the caller asked him to log into his banking. The refund appeared: $9,089, not $89. The caller became distressed — he would be sacked, he had typed an extra zero, could the difference be sent back today. The teacher transferred $9,000 while the caller stayed on the line to “confirm it went through”.
Step by step
- 10:40am
Unsolicited call about a small refund. Nothing is asked for. A refund is offered.
- 10:52am
He installs a remote-access app so the caller can “see the form”. The caller now sees everything.
- 11:06am
He logs into internet banking while connected. His savings balance is visible to the caller.
- 11:11am
$9,089 appears in his everyday account — moved from his own savings account, in another window.
- 11:19am
The caller panics about his job. The teacher, trying to help a young man in trouble, sends $9,000 to an account he is given by phone.
- Next day
The bank explains the “refund” was his own money. The $9,000 that left was also his. Nothing was ever refunded.
How to avoid being the mule
- No real organisation needs to see your screen to give you money back. A refund goes to the card that paid; it needs nothing from you.
- A balance that changes while someone is connected to your device tells you nothing. They can move your money between your own accounts and call it a payment.
- Distress is a tool. “I’ll lose my job” is scripted, because it makes a decent person act fast to help someone else.
- If someone stays on the phone while you transfer, that is not customer service. It is supervision, to stop you thinking.
What this pattern usually looks like
This one starts with a refund you were not expecting: a subscription you cancelled, an overcharge, a compensation payment. To “process” it, the caller asks you to install remote-access software — AnyDesk, TeamViewer, QuickSupport — so they can help. Once they are on your device, they either move money between your own accounts so your balance appears inflated, or they push through a transfer from an account they already control. Then comes the apology: they typed an extra zero, they will lose their job, please send the difference back. The money you send back is real and it is yours. The refund was theatre. Because the transfer looks like it came from you, on your device, from your IP address, banks treat these disputes as unusually hard — which is why stopping before the return transfer matters more than anything you do afterwards.
Where to report it in Australia.
- Your bank’s scam page
Every major Australian bank runs a 24/7 fraud line. The number on the back of your card is the fastest route.
- ReportCyber
Where a cybercrime report goes to police. Use this if money moved, or if someone had remote access to your device.
- Scamwatch (National Anti-Scam Centre)
The national report. It feeds the disruption work — even if you lost nothing, the report helps.
- IDCARE1800 595 160
Free national identity and cyber support. A real person builds you a response plan. Not a government agency, not a debt collector, not paid.
- ASIC MoneySmart
Independent, ad-free money guidance from the regulator.