A fake check for 51 dollars arriving at home, accompanied by a formal letter and references to US institutions: this is how a new attempt to overpayment scamalready dubbed as the Amazon fake refund scam. By analyzing the phenomenon, we see how scammers combine authentic information – such as a real-life lawsuit against Amazon in the United States – with well-known manipulation techniques in the field of cybersecurity. The result is a sophisticated mechanism that can mislead, especially less careful users. Let’s see how the scam works and how to defend yourself.
Where did the $51 Amazon refund scam come from?
Between 2019 and 2025, Amazon faced prosecution in the United States related to its handling of Prime memberships. The authorities have contested non-transparent practices, in particular the use of interfaces designed to make it difficult to unsubscribe: these schemes are known as “dark patterns”, i.e. design solutions that guide the user’s choices without them realizing it. The agreement reached between the US authorities and Amazon provided for reimbursements of limited amounts (up to 51 dollars) but, and this is the central point to keep in mind, exclusively for US users directly involved in the matter.
Scammers have taken these real items and repurposed them in deceptive ways. Thousands of people, including in Europe, have received small checks in the mail accompanied by apparently official letters. In some cases, like the one documented in Formigine, the delivery even took place by hand, with the victim’s personal details already known to the scammers. This suggests possible illicit access to databases containing biographical information.
Inside the envelope that is delivered to the home is a check for 51 dollars from the United States, issued by a bank based in Columbus, Ohio: the Huntington National Bank. The check is accompanied by a communication in English, which cites the Federal Trade Commission, the American consumer protection authority, and an alleged agreement with Amazon relating to the management methods of the Prime subscription, recalling specific legislation on online commerce. The document invites you to collect the sum by a certain date and provides, at the end, the web address to visit to receive payment via PayPal.
The scam mechanism: how it works
The scam mechanism is based on two main techniques. The first is the overpayment scam. It works like this: the victim deposits the check into the bank, which initially credits the sum during the checks. Subsequently, the scammers contact the person claiming that there has been an error and ask to return the money via bank transfer or other digital systems. When the check turns out to be false or bounced, the money sent is now irrecoverable, and the bank reverses the amount and the victim remains responsible for the sum already spent or transferred.
The second technique is the much more well-known phishing. By visiting the website suggested in the communication received by mail, you would end up on a copy of the PayPal site, graphically identical but controlled by the scammers. By entering login or banking credentials into these sites, the victim delivers them directly to the scammers.
It is important to clarify that actual refunds related to the US dispute do not involve sending paper checks abroad. Official communications occur through verified, digital channels and only concern users who meet specific criteria and reside in the United States. There is no active procedure for European citizens.
How to defend yourself
Now that it’s a little clearer how the scam works, let’s also see how to defend yourself. First, if you receive letters and checks for no good reason, ignore them, so don’t visit the addresses advertised in the communications in question, and don’t cash suspicious checks. Another important thing to do is to promptly report these incidents to the competent authorities (such as the Postal Police), so as to protect yourself and help limit the spread of the phenomenon.
