The refund that needs your bank details to process

An email says a payment failed and you are owed money back. A call says an overcharge was found on your account. Either way there is a sum in your favour and a short form to complete. A refund scam is a fraud that arrives as money coming towards you, and it works because being owed something switches off the caution that being asked for something turns on.

The mechanics are the same as every other payment fraud. What is different is the framing, and the framing is doing nearly all the work.

Why does an incoming payment lower your guard?

Three reasons, and they compound.

• You are the creditor. Someone owes you. Creditors ask fewer questions than debtors.
• The action feels administrative. Confirming details to receive money is paperwork, not a decision.
• There is a plausible origin. A subscription you did cancel, a delivery that was late, a shop you did use.

That third one is why these arrive after a real event. The information is often correct — the merchant name, roughly the right amount, a date that fits. It is correct because it was guessed from a large batch, or taken from a breach, and you are the person it happened to fit.

A refund goes back the way it came. Any process that needs new details is not a refund, whatever it is called.

The one fact that ends most of these

Refunds are reversals. Card payments go back to the card that paid, bank transfers to the account that sent, and neither needs anything from you at all.

That single sentence disqualifies almost every refund scam. If a genuine merchant refunds you, you find out because the money appears — not because you completed a form. There is no legitimate refund process that requires your card number, your login, a code from your phone, or a payment from you first.

Two edge cases exist, and they are worth naming so the rule holds:

A closed account. If the card was cancelled, a merchant may need alternative details — but the conversation starts with you contacting them about a refund you already know about, not with them contacting you.

A cheque or transfer from an insurer or authority. Slower, and they write to you with a reference you can verify by calling the number on their official site rather than the one in the letter.

In both cases the test is the same: you initiated it, using contact details you looked up.

The refund scam that targets small businesses

If you invoice people, this refund scam arrives inverted and it is more convincing.

A customer says they were double-charged, or paid the wrong amount, and asks for the difference back. Sometimes they really did pay twice — with a stolen card. You refund the overpayment to their account, the original payment is later reversed as fraudulent, and you have lost both.

The defences are specific and boring:

• Refund to the original payment method only, never to a different account or a new card.
• Wait for funds to clear before refunding anything, particularly on a transfer.
• Match the refund to a payment in your own records, not to a screenshot they sent.
• Be suspicious of urgency in an overpayment. A genuine one is an inconvenience, not an emergency.

The screenshot point matters more than it sounds. A payment confirmation image proves nothing — it takes two minutes to fabricate — and anyone who cannot wait for you to check your own account is telling you why. Keeping the invoice and the payment linked in one place makes that check a lookup rather than a search, which is what tools like Ordava are for, and any system that does it works.

How do you check without engaging?

Never using the message. That is the whole method.

1. Stop reading and open your own records. Was there a payment? What was the real amount? A refund you cannot find an original for does not exist.
2. Contact the merchant through a channel you already have — the app, the site you typed, the number on your card.
3. Ask them to state the amount and the original transaction. A real one knows both. A caller who asks you to confirm the details is collecting them.
4. Never move money to receive money. No legitimate refund has a fee.

Step 3 inverts the usual dynamic and it is the most useful thing here. Fraud depends on you supplying the specifics it lacks; asking the other party to go first costs you nothing and collapses the call.

Our guide to the four questions that identify almost any scam covers the general test, and the invoice variant is dealt with under shopping scams.

The three channels it arrives on

A refund scam uses three doors, and each has a tell worth knowing.

Email is the highest volume and the lowest effort. The tell is the sender domain — not the display name, which is free to set. A refund from a shop you used will come from that shop's domain, and reading a domain properly is covered in suspicious links.

Phone is the most effective, because a voice creates pressure a message cannot. The tell is that they contacted you and then asked you to prove who you are. A real institution knows who it called.

Text sits in between and relies on a link. Around 4 in 5 of these carry a shortened or lookalike address, and the reliable move is to not open it at all — open the app instead.

One pattern crosses all 3 channels: a deadline. A refund that expires in 24 hours is not a refund, because money you are owed does not stop being owed. Urgency exists to remove the gap in which you would have checked, and that gap is the whole defence.

If you already gave something away

Speed matters more than embarrassment, and the order is worth knowing before you need it.

If you shared card details, call the number on the back of the card and freeze it. Most banking apps do it in two taps, immediately, and a frozen card can be unfrozen.

If you shared a login or a code, change the password from a different device and revoke active sessions. A code you read aloud has usually already been used.

If you granted remote access, disconnect from the network, then treat every account opened on that machine as exposed. Change the email password first.

If you paid a fee, report it the same day. Card payments and transfers have different recovery windows and both are measured in days rather than weeks.

What does not help is calling the number back to ask for the money returned. It confirms the line is live and produces a second approach, often presented as a recovery service. The Action Fraud reporting service is the right destination in the UK, and the equivalent authority elsewhere.

The one-line version

Money coming towards you needs nothing from you. A refund returns by the route the payment took, so any refund that requires your card number, your login, a code, or a payment is not a refund — it is the fraud, wearing the one costume that makes people helpful.