How remote-access “refund” scams drain the account they claim to be filling.
The refund is real on screen and imaginary everywhere else. Here is the mechanism, step by step.
The opening is generous, not threatening
These calls do not start with a threat. They start with money you are owed — a subscription refund, a billing error, compensation for an outage. It disarms the part of you that is listening for a scam, because scams ask for money and this one is offering it.
The amount is small enough to be believable. Eighty-nine dollars. A hundred and twelve. Nobody invents a fake refund of $9,000 as an opener, because that is the second act.
The software is the whole scam
To "process" the refund you are asked to install a support tool — AnyDesk, TeamViewer, QuickSupport, or something with a name you have never heard. These are legitimate products used by real IT departments, which is exactly why they work here.
Once installed, the caller can see your screen and, in most configurations, control it. Some will blank your screen at the critical moment and tell you it is a security feature. It is not a security feature.
How the "overpayment" appears
You are asked to log into internet banking so the refund can be confirmed. Now the caller can see every account you hold, including savings.
The inflated balance is produced one of two ways. Usually they move your own money between your own accounts — from savings to everyday — so the everyday balance jumps by $9,000 that was always yours. Occasionally they edit what is displayed on the page. Either way, no money has entered your world from outside.
The apology, and the transfer
The caller then discovers their "mistake" and becomes upset. They will be sacked. They have a family. The company will take it from their pay. Would you please return the difference today.
The money you send is real, it is yours, and it goes to an account they control. Because you made the transfer, from your device, after logging in yourself, disputing it afterwards is genuinely hard. This is why the only step that reliably works is the one before the transfer.
- Hang up. You can always ring the company back on a number you found yourself.
- Disconnect the device from the internet before uninstalling the remote-access app.
- Change your banking password from a different device.
- Ring your bank on the number on your card and tell them someone had remote access.