Nothing superfluous: how scammers speculate on the topic of refunding overpayments
Fraudsters can speculate on the topic of refunding various overpayments, including for housing and communal services, experts have warned about this. Such scam schemes are gaining relevance in late winter and early spring.: They take advantage of the fact that reports of recalculation of funds do not arouse caution and are perceived as a legitimate action on the part of departments or service providers. For more information about how scammers speculate on the topic of refunding overpayments, how dangerous their schemes are and how to protect themselves from them, read the Izvestia article
Why is the topic of refund of overpayments interesting to scammers
The topic of refunding overpayments is attractive to intruders, because it relies on a motive that everyone understands — the return of money already spent, Konstantin Larin, head of the cyber intelligence department at Bastion, says in an interview with Izvestia. Reports of recalculation of funds do not cause concern and are perceived as a legitimate action on the part of departments or service providers.
—The topic of refunding overpayments is psychologically very convenient for scammers, because it combines several triggers at once: the expectation of "unexpected" money, trust in government and municipal structures, as well as limited time to make a decision,— said Alexander Vinokurov, technical account manager at R-Vision.
According to the expert, most citizens do not keep accurate records of charges for housing and communal services and cannot immediately check whether there was an overpayment, so the message about the refund looks plausible and does not cause instant suspicion. In addition, most often the amount of overpayments is small (usually from 2 thousand to 3 thousand rubles), which also almost does not cause alertness among potential victims, adds Maria Mikhailova, head of the Angara MTDR brand protection group.
What kind of fraudulent schemes to refund overpayments are expected in 2026
Fraudulent schemes on the topic of refunding overpayments are most effective in months with a large number of days off and, as a result, with increased resource consumption, says Alexandra Shmigirilova, GR director of the Security Code information Security company.
— For example, this is January, when people are at home and electricity and heating costs are rising; May is when holidays are often spent in dachas using heaters; the autumn months before the start of the heating season are when residents turn on electric heaters when it gets cold, — says the interlocutor of Izvestia. — The higher the final utility bill, the more likely the scammers are to attract the victim's attention by offering to refund some kind of "overpayment."
In 2026, such schemes are likely to appear in waves — after the January recalculations, at the end of the heating season in spring, and also in autumn, when tariffs traditionally rise and the number of payments increases, Alexander Vinokurov agrees. At the same time, according to the expert, one can expect not only SMS and messenger mailings, but also phone calls with "EIRC operators" or "management company specialists", as well as fake letters with visually accurate copies of official portals and "Public Services".
However, fraudulent schemes on the topic of refunding overpayments can also occur during the summer season, when residents are often away, Maria Mikhailova notes. The fact is that the official recalculation procedure is possible even if they are absent for a long time at the place of permanent registration. Criminals use not only instant messaging and SMS messages, but also create fake chatbots disguised as official services of regional settlement centers and housing management companies.
"In addition to refunding overpayments for housing and communal services, fraudsters can also turn to the topic of refunding "overpayments for taxes," says Alyona Yartseva, an analyst at Positive Technologies, "the latter topic may be relevant for intruders throughout the year in accordance with the payment schedule.
What fraud schemes on the topic of refund of overpayments have you encountered before
Fraudsters have used various schemes to compensate for overpayments before: for example, in the summer of 2024, criminals called elderly people posing as employees of energy supply companies and other housing and communal services, says Maria Mikhailova. Callers informed pensioners about the possibility of recalculating the cost of services, taking into account the benefits provided by law.
— They also used "legends" about the "anniversary of the organization", government initiatives to support the population and other reasons to compensate for overpayments, — says the interlocutor of Izvestia. — The victims were asked for personal data and forced to follow phishing links that led to fake pages of the portal of public services or banks.
In previous years, fraudsters often used messages about compensation for overpayments for heating or "meter refunds", as well as schemes with tax refunds or compensation for communication services, adds Mikhail Sergeev, a leading engineer at CorpSoft24. They often used fake websites of "Public Services" or banks.
Due to the fact that phishing on the topic of refund of overpayments is widespread, the portrait of its victim is quite general, says Alena Yartseva. In such situations, the important thing for scammers is not quality, but quantity. The more users who receive the message, the more likely it is that some of them will go to the site and give their data to intruders.
— The target audience of such schemes is people who use personal accounts for payment and do not always check incoming information, — says Alexandra Shmigirilova. — If a person believes that there is an overpayment, they can click on the sent link or visit the specified site without verifying its authenticity.
As a result, malware can be installed on his device, giving fraudsters access to all information. Or a person enters their own data (logins, passwords, card details) on a phishing page — and they instantly fall into the hands of intruders, the expert warns.
How to protect yourself from fraud schemes on the topic of refund of overpayments
In order to protect yourself from fraudulent schemes on the topic of refunding overpayments, experts interviewed by Izvestia advise following a number of safety rules. So, according to Maria Mikhailova, it is important to remember that all accurate information regarding the payment of utilities is provided exclusively through the user's personal account on the official portal of public services of the region or the website of its management company. There you can check the correctness of the invoices and consult with the operator online.
— Information about the debt and the reasons for the recalculation can also be clarified directly at the branch of the multifunctional center (MFC), the local unified settlement center or the management company, — says the expert.
At the same time, no organization responsible for housing and communal services distributes notices of debt or the right to compensation via SMS, messengers or social networks, collects personal information online and does not ask for bank card details to return allegedly overpaid funds.
In turn, Lev Afanasyev, head of Innostage's anti-fraud department, advises against entering data on suspicious sites and not transmitting information with SMS codes to third parties, as well as not clicking on links from messages, but double-checking them on official resources. This applies not only to links, but also to phone numbers.
— Use two-factor authentication wherever possible, and if in doubt, discuss the situation with someone from your family or good friends, — the expert advises. — At the same time, be especially suspicious of messages that do not recommend or even prohibit this.
In general, methods of protecting against fraud on the topic of refunding overpayments are quite standard — it is necessary to improve your financial and legal literacy, as well as double-check information based on official sources, concludes Alexander Vurasko, Director of Development at the Solar AURA External Digital Threat Monitoring Center (Solar Group). If you have any doubts, you should contact the state authorities for clarification.
Переведено сервисом «Яндекс Переводчик»
