US prosecutors charged 28 people over an alleged $65M scheme where callers faked refunds to trick seniors into sending cash. How the refund trick works.
Social Engineering Examples·6 sources
In August 2025, US prosecutors unsealed four indictments charging 28 people in an alleged $65 million scheme against older Americans. Prosecutors say India-based call centres tricked victims with fake tech-support, bank, government and "mistaken refund" stories, while a US-based network linked to Chinese organised crime collected and laundered the money, often as cash sent in packages. YouTube scambaiters helped investigators. By June 2026, eleven defendants had pleaded guilty. Status: Charged; partly convicted.
| Step | What prosecutors allege |
|---|---|
| Contact | Unsolicited pop-up ads, emails and phone calls |
| Story | Tech support, a bank, a government agency, or a refund gone wrong |
| Access | Victims were talked into installing remote-desktop software |
| Payment | Victims sent money, often cash in packages addressed to fake names at short-term rentals |
| Laundering | A US network collected the cash and moved it on |
It's a mix of tech support scams, callback phishing and vishing, with a cash courier on the end.
The caller says you've been given a refund, then claims too much was sent by mistake. With remote access to your computer, they can edit what you see so it looks like extra money really landed in your account. Then they ask for the difference back, by cash, wire or gift cards. Because it feels like returning money that isn't yours, people comply. No money was ever sent to you in the first place.
Tip: no real bank or agency asks you to return a refund in cash, by courier or with gift cards. That request alone means it's a scam.
Prosecutors in the Southern District of California announced the charges on 27 August 2025, with IRS Criminal Investigation. The scheme had allegedly run since at least 2019. Videos posted by the YouTube scambaiting channels Scammer Payback and Trilogy Media helped investigators identify alleged members and understand how the network worked.
By 30 June 2026, eleven defendants had pleaded guilty, Courthouse News reported. Hua Wang admitted responsibility for more than 2,000 victim cash packages and $64 million in stolen money between 2019 and 2023. The other defendants' cases aren't all public yet, so their roles remain allegations.
See also how to prevent vishing.
A scammer says you were refunded too much by mistake and asks you to send the difference back. The refund never happened.
Prosecutors allege $65 million. One defendant who pleaded guilty admitted responsibility for $64 million.
Videos from Scammer Payback and Trilogy Media helped investigators identify alleged members and see how the scheme worked.
Eleven of the 28 had pleaded guilty by June 2026. The rest remain accused.
Social Engineering Examples. “US 'mistaken refund' elder fraud ring: 28 charged over $65M (2025)”. Accessed 3 November 2026. https://socialengineeringexamples.com/chinese-organized-crime-mistaken-refund-elder-fraud-2025
The call centers contacted potential victims through unsolicited pop-up ads, emails, and phone calls.
Treat unsolicited phone calls, emails, and pop-up ads directing recipients to call supplied numbers as suspicious.
Victims received an unsolicited phone call, email, or computer pop-up warning of a fabricated billing or refund error and directing them to call a phone number; per the indictment, that number actually routed to an India-based scam call center rather than any real bank, government agency, or tech company.
Treat any unsolicited call, email, or pop-up instructing you to call a number as inherently suspicious, and never call the number it provides; look up the institution's number independently, from a bank statement or the official website, and call that instead.
Per the indictment's description of conspirators using "social engineering techniques to build trust," callers posed as tech-support agents, bank employees, or government officials and used scripted lies to establish credibility and keep the victim engaged.
No legitimate bank, government agency, or tech-support provider initiates unsolicited contact and pressures a decision within the same call; awareness education for the targeted demographic on this specific fast-trust-building pattern is the practical control, since the call itself cannot be intercepted before it happens.
The caller convinced the victim to install commercial remote-desktop software and grant control of their computer, a step DOJ's account describes as central to the scheme and that gave the scammer a persistent channel to control what the victim saw on their own screen.
Remote-desktop or screen-sharing software requested by an unsolicited caller is a hard stop; family and community education campaigns for elderly relatives are the main lever here, since once access is granted the scammer controls what the victim sees next.
Using the remote session, the scammer staged a doctored on-screen balance or transaction showing an erroneous overpayment or refund in the victim's bank or investment account, manufacturing visual "proof" the victim had no independent way to check.
Because the scammer controls the victim's screen at this point, no on-screen "proof" can be trusted; the effective countermeasure is upstream, refusing remote access in the first place (Stage 4), or independently verifying any account balance via a separate device or a callback to the institution using an independently sourced number.
The caller pressured or threatened the victim to "return" the fabricated overpayment immediately, framing it as a legal or moral obligation, per DOJ's account, to short-circuit any pause to verify independently.
Recognizing manufactured urgency, being told to act now or face legal consequences, as a scripted manipulation tactic rather than standard institutional process, and building in a mandatory pause to call a trusted family member or the institution back, breaks the pressure loop.
Victims were instructed to send funds by wire transfer or gift card, or, per the indictments and plea agreements, to withdraw bulk cash and ship it via overnight or express courier to fictitious names tied to false IDs at short-term rental addresses controlled by the US-based collection network.
A legitimate refund or bank correction is never returned via wire transfer, cash courier, or gift card; financial institutions and retailers can flag and delay large cash withdrawals or bulk gift-card purchases by elderly customers, and courier carriers can flag high-volume cash-package patterns addressed to short-term-rental addresses.
US-based network members, paid per package, collected the courier shipments at rotating short-term rentals under a documented "hub-and-spoke" booking pattern (per Zhao's plea agreement) to launder the physical cash and evade detection, completing the transfer of stolen funds from victim to the India-based call centers' US collection arm.
At this stage, investigation may rely on financial, courier and rental records and cooperation across jurisdictions. The reported investigation was aided by YouTube sting videos that helped identify participants and illuminate the alleged scheme.
Browse by what this case has in common with others in the library.
In June 2025 the DOJ filed to forfeit $225.3M in USDT tied to pig butchering scams, after Tether and OKX…
An Austin man lost $1,408,850 to a fake DAIQ crypto platform found on LINE. A staged $40,000 handoff led police…
Censys traced a USPS 'package awaiting action' smishing kit to 682 lookalike sites that streamed card numbers as victims typed.…
A phone-record pretexting incident involving a retired U.S. Army general was followed by FTC enforcement and broader privacy-policy scrutiny.
A fraudster spoofed Wells Fargo's real 800 number nine minutes after a legitimate advisor call, phished a 2FA code from…
Fake finance "directors" in WhatsApp groups steered 18+ US investors to NanoBit, a crypto platform that never traded. The SEC…
Two unencrypted TD Bank backup tapes carrying data on 260,000 customers vanished in transit between Massachusetts offices in 2012.
iSpoof was a UK-run, Bitcoin-paid website that let fraudsters display a real bank's number and capture the codes victims keyed…
The CEO of a UK energy firm was tricked into wiring €220,000 (~$243,000) to a Hungarian account in March 2019…
P&G-hired competitive-intelligence contractors obtained confidential Unilever hair-care information from discarded garbage before P&G self-disclosed the operation, fired three employees, and…
Anthropic says a suspected Chinese state group conned Claude Code with a fake pentest story and let it run most…
Texts about unpaid tolls copied E-ZPass, SunPass and more to steal card details across the US in 2024 and 2025.…
A fraudster posing as AFGlobal's CEO, backed by a fake KPMG "attorney," pressured the accounting director into wiring $480,000 to…
A compromised Constant Contact mass-mailing account let Russia-linked Nobelium (APT29) send USAID-spoofed phishing emails that funneled roughly 3,000-7,000 accounts across…
A phone-record pretexting incident involving a retired U.S. Army general was followed by FTC enforcement and broader privacy-policy scrutiny.
Prosecutors say a grandparent scam run from call centers in the Dominican Republic hit hundreds of elderly Americans and took…
eSentire's Threat Response Unit says it shut down 10 attacks on six unnamed law firms across January and February 2023,…
A 12-person ring watched hacked inboxes for big payments, then redirected them with fake emails. Trial evidence put losses above…
Fraudsters posing as RBS fraud-team staff talked Hamilton Academical FC's sole authorised banking employee into moving nearly £1 million into…
GootLoader operators hijacked Google search rankings for legal-agreement phrases, luring law firm staff to fake forum "direct download" pages that…
Belgian bank Crelan lost close to EUR 70 million (~US$75.8M) after fraudsters impersonating its CEO induced internal staff to execute…
A 2025 campaign faked Portugal's tax authority and asked victims to paste a command to 'enable file preview', starting a…
In March 2022, LAPSUS$ (DEV-0537) leaked an archive it said held 37GB of Microsoft source code. Microsoft only confirmed that…
Dubai Police raided nine pig butchering centres and arrested 275, and San Diego charged six alleged scam-compound managers and recruiters.…
Social Engineering Examples