Short answer: Separate a genuine refund correction from a request that makes you send real money against a false credit.
Define what could go wrong
Someone claims they refunded too much and asks you to return the difference immediately. The useful question is not whether one detail looks convincing. It is whether the identity, channel, context and requested action agree when checked independently.
Separate identity from appearance
Read these observations together. One item may have an innocent explanation, while several mismatches can justify stopping before money, access or personal information changes hands.
The credit appears only in an email
The credit appears only in an email. This matters because the visible message may be controlled by the same person asking you to trust it. A useful counter-check is to check the original payment account directly.
The sender chooses a different repayment method
The sender chooses a different repayment method. This matters because the visible message may be controlled by the same person asking you to trust it. A useful counter-check is to ask the provider to reverse its own transaction.
The request arrives before funds settle
The request arrives before funds settle. This matters because the visible message may be controlled by the same person asking you to trust it. A useful counter-check is to do not repay by gift card or cryptocurrency.
The sender threatens legal or account action
The sender threatens legal or account action. This matters because the visible message may be controlled by the same person asking you to trust it. A useful counter-check is to save the conversation and transaction record.
Move to a known channel
Use a route that does not depend on the contact, link, attachment or account being assessed. Preserve the original evidence first when fraud, account compromise or a payment dispute may need to be reported.
- Check the original payment account directly.
- Ask the provider to reverse its own transaction.
- Do not repay by gift card or cryptocurrency.
- Save the conversation and transaction record.
Compare weak and stronger evidence
| Observation | What it supports | Independent response |
|---|---|---|
| The credit appears only in an email. | Raises a question, but is not proof by itself. | Check the original payment account directly. |
| The sender chooses a different repayment method. | Raises a question, but is not proof by itself. | Ask the provider to reverse its own transaction. |
| The request arrives before funds settle. | Raises a question, but is not proof by itself. | Do not repay by gift card or cryptocurrency. |
| The sender threatens legal or account action. | Raises a question, but is not proof by itself. | Save the conversation and transaction record. |
Remember these points
- Pause before the requested action becomes difficult to reverse.
- Verify the person or organization through contact details you found independently.
- Keep records of the request, your checks and any transaction or account change.
- Escalate to the relevant provider or authority when money, identity or active access is at risk.
For a broader check, continue with the trust.you research and review method.
Do not turn caution into certainty
Account entries can be provisional, and a later reversal can leave your separate repayment unrecoverable. The purpose of this review is to choose a safer next action, not to label a person or message with certainty. Conditions, platform controls and legal rights vary, so use the relevant provider or authority for a high-consequence decision.
Official guidance
FTC phishing guidance provides primary guidance related to this topic. Procedures can change, so use the source for current reporting or recovery steps.
This first-party field note was reviewed for a distinct reader decision, independent checks, practical limitations and a natural route into the wider guide library. It entered the Monday, Wednesday and Friday publishing queue. Read our policy.