Is That Refund Email a Scam? Spot the "Overpaid" Trap

If a refund email or text arrives for something you never returned, or for an amount you did not expect, treat it as a scam until you have checked it yourself. You check it by ignoring every link and phone number in the message and opening the store's app or website on your own. A real refund will already be in your order history. A fake one will only exist in the message.

A real refund shows up in your account. A fake refund only shows up in the message.

The reason this matters right now: we are heading into the months when the most returns, and the most scam messages, happen. A report from the messaging company Infobip, covered by Retail Insider on 14 October 2026, found that December had the highest volume of harmful messages it detected in 2025, with November close behind. Busy return season gives a fake refund notice perfect cover.

Why do scammers pretend to send you a refund?

Because a refund feels like good news, and good news lowers your guard. A bill makes you suspicious. Money coming back to you makes you want to click.

The Federal Trade Commission studied this exact pattern when it looked at people pretending to be one very large online retailer. In its Data Spotlight published in October 2021, covering July 2020 to June 2021:

• About 96,000 people reported being targeted by someone posing as that retailer, about one in three of all business-impersonation reports.
• Nearly 6,000 said they lost money, more than $27 million in total, with a median loss of $1,000.
• People aged 60 and over were more than four times as likely as younger people to report losing money to these impostors, with a median loss of $1,500.
• About 70% of the reports said the first contact was a phone call, 15% a text and 8% an email.

The problem did not go away. In May 2024 the FTC said that in 2023 the most impersonated companies were Best Buy and its Geek Squad brand (about 52,000 reports), followed by Amazon (about 34,000) and PayPal (about 10,000). These are the brands people already shop with, which is exactly why scammers borrow their names.

How does the "you were overpaid" refund scam work?

This is the version that empties real bank accounts, and it is worth knowing step by step. The FTC's 2021 spotlight describes it like this:

1. The hook. You get a call, text or email about "suspicious activity" or an order you did not place. You are told a refund is waiting.
2. The remote access. A friendly "agent" asks you to install an app so they can see your computer or phone and "process the refund."
3. The fake mistake. The agent types in a refund that is far too big, for example by adding extra zeros, then panics and says they made an error.
4. The illusion. With access to your online banking, the scammer can move your own money from savings into checking. You see a big deposit and believe it is their refund.
5. The ask. You are begged to "send back the difference," often by gift card, with the agent claiming they will lose their job if you do not.

Every dollar you send back in step 5 was already yours. Nothing was ever refunded.

A second version targets people who have already been scammed once. The FTC's guidance on refund and recovery scams warns that crooks buy lists of past victims and then call offering to get the money back, for an upfront "processing fee," "retainer fee," "administrative charge," "tax" or "shipment and handling charge." The FTC is blunt about it: never pay upfront for help getting a refund.

What are the warning signs of a fake refund email or text?

Most fake refund messages share a handful of tells. Any one of them is reason enough to stop and check.

If you want the deeper story on how the payment request itself gives a scam away, see our earlier piece on which payment methods scammers use, and the FTC's warning that no real business asks to be paid in gift cards.

How do I check whether a refund is real?

This takes about a minute, and it works for any store, bank or payment app.

1. Do not tap anything in the message. No links, no "reply STOP," no call-back number.
2. Ask yourself one question. The FTC suggests asking whether you actually have an account with the company or know who contacted you. If not, it could well be phishing. If you do, still check on your own, as below.
3. Open the app or type the website address yourself. Go to your orders, returns or refunds page.
4. Match it. A real refund will show the same order and amount there. If there is nothing, the message is fake.
5. Still unsure? Call a number you already trust, such as the one on the back of your card or inside the official app, never one from the message or from a search ad. The FTC spotlight notes that some people who searched online for a customer service number reached scammers instead.

What should I do if I already clicked or paid?

Move quickly. The first three steps come straight from the FTC's guidance; the last two are plain common sense.

• If you clicked a link or opened an attachment: update your security software, run a scan and remove anything it flags.
• If you shared card, bank or Social Security details: go to IdentityTheft.gov, which gives steps based on what was exposed.
• If you sent money: contact whoever you paid through, right away, and ask them to stop or reverse it. The FTC says to act fast.
• If you gave a password: change it on that account and anywhere you reused it, and turn on two-step sign-in, which the FTC recommends for every account anyway.
• If someone had remote access: take the device offline and get it checked before you sign in to your bank on it again.

Then report it. Forward phishing emails to reportphishing@apwg.org, forward scam texts to 7726 (it spells SPAM), and file a report at ReportFraud.ftc.gov. For refund and recovery scams, the FTC also suggests telling your state attorney general. Here that means the attorney general for Maryland, Virginia or the District of Columbia, wherever you live.

The bottom line

A refund is never something you have to pay to receive. If a message says money is coming to you, close it and look in your own account. If the refund is real, it will be waiting there. If someone needs remote access, a gift card or "the difference" back, you have your answer.

The same habit works with us: if a message about a DealsDMV order ever looks off, sign in on the site yourself and look at the order there, and see our FAQ for how buying with us works. Browse Buy Now deals or live auctions the same way: from the site, not from a link someone sent you.

Know someone who gets a lot of "you have a refund" texts? Send them this. It might save them a lot more than a refund.