How Scammers Exploit "Refund Offers": Creative Examples and Funnel Breakdowns

Beyond gray-area verticals, social media is also full of creatives advertising non-existent services. Today we'll break down one of many chargeback funnels, where users are offered help "dealing with" financial brokers and recovering their funds. 

What are "refund offers"?

A refund is the cancellation of a financial transaction, carried out at the client's request or by a service's decision. For example, you order something on Rozetka and then cancel the order — the seller is obligated to return the funds. 

In CPA marketing, there's a concept known as a refund or chargeback. Typically, sellers on forums and other platforms sell contact databases of forex broker clients or other financial service users. These lists can be used to spam users and pitch them loans, microloans, and other offers.

Sellers can even offer segmented lists based on various criteria: region, language, client deposit amount, interest in crypto investments. Even without deep analysis, it's clear that this is leaked data from the brokers' own databases and other financial service providers. 

Chargeback databases are also frequently used for scams. Broker and bank clients are offered debt write-offs or deposit refunds — in short, scammers use every trick in the book to extract even more money from them under the guise of solving their problems.

The personal and corporate bankruptcy services niche does exist, but it operates on a different model. For example, if a client took out a large loan from Monobank and can't repay it, they can work with lawyers to declare bankruptcy and defer payments. However, legal firms don't assist with cases involving financial brokers. They also always sign a contract and a power of attorney to represent the client's interests in court — rather than simply making empty promises. 

Interestingly, users readily trust such advertising and hand their money over to fraudsters — even though, without any OSINT skills, it's easy to see that there's no magic wand that can quickly recover funds from a broker or bank. 

User acquisition funnel

Fraudulent ads appear primarily on Facebook and Instagram. Creatives promise users quick solutions to all their problems. Scammers press on pain points to get the client to reach out as fast as possible.

Examples of ad copy hooks:

• Were you scammed by a broker or financial organization❓Don't give up! We know the solution to your problem — a chargeback.
• ✅ Our law firm has been fighting fraudsters for over 25 years and recovering funds for their victims.
• Find out whether your money can be recovered. You only pay for our services once your funds are returned!
• If your money was stolen, our company specializes in recovering funds from fraudulent brokers. Contact us now!
• Were you scammed by a fraudulent broker for more than $1,000? 💵 Find out how to recover 100% of your funds in 7 days⚖️

Scammers lure clients with a range of enticing promises: free consultation, 100% guaranteed results, minimal commission, recovery within 7 days, no upfront payment, and more. 

In addition to text-based creatives, there are also fairly well-produced video ads. The first video below features a compelling script: potential clients are shown what appears to be a special forces raid on a broker's office, with footage spliced in from unrelated searches that have nothing to do with financial fraud. 

Notably, some videos feature Russian-style documents while the special services depicted are Ukrainian. Additionally, most creatives targeting Ukraine are written in Russian — which suggests that the fraudsters are simply stacking every possible GEO they can.

Find more useful materials on traffic work in the "Articles" section

In spy services, there are plenty of creatives targeting Kazakhstan that incorporate national elements: representatives of local ethnic groups, the national flag. It feels like one team is driving the approach while others are simply copying their playbook.

The second step after viewing the creative is clicking through to the "law firm" website. From there, the funnel can go one of two ways. The first — completing a 5–7 question quiz and submitting a lead form with contact details. The second — a quick, streamlined application form.

In SPY services, you can find fairly high-quality landing pages spanning 5–6 blocks, complete with polished design, staff photos, testimonials, and other trust elements. These likely convert quite well.

We checked the registration dates of several domains and found that none of them were more than 4–5 months old. In some cases, the ads in the targeting promote domains so fresh they didn't even exist a few days prior. This is where the fraudsters slip up — though it's unlikely their target audience will bother to dig that deep.

Telegram channels are also frequently used as pre-landers within these funnels. Subscriber counts are artificially inflated, and "useful" content is shared to warm up the audience toward paying for services.

If a broker's or other financial institution's client responds positively to the scammers' pitch, they'll end up losing even more money to these fake "lawyers." They'll be contacted, questioned, and asked to pay an upfront fee or pre-pay a commission. After that, it's the classic playbook — the company vanishes into thin air. It's better to scroll past such ads or report them to Facebook support.

Bottom line: Russian scam operations in wartime are nothing new. But fraudsters are also running ads targeting Ukrainian audiences. Refund scams are exactly that — scams — and Ukrainians are better off not handing their money to fraudsters, but donating it to the needs of the army instead.