September 24, 2026, 8:40 am | Read time: 3 minutes
A surprising refund of nearly 400 euros sounds tempting. This is exactly the promise scammers are currently using to trap policyholders of the German Pension Insurance. The emails promise an alleged refund of overpaid contributions.
Scammers lure with alleged refund
As the Consumer Center NRW warns, criminals are sending emails that at first glance look like official letters from the German Pension Insurance (DRV). With a similar writing style and professional design elements, the scammers aim to make their message appear credible and gain the recipients’ trust. This is accompanied by an official-sounding subject line like “Contribution refund approved for payout.”
In the current case, the scammers claim that policyholders paid too much in pension insurance contributions in 2024 and 2025. Therefore, a refund of 387.44 euros is due. To receive the money, recipients are merely asked to confirm their bank details via a link.
Why the email seems convincing
Phishing messages often use general promises or unrealistic sums of money. According to the Consumer Center, the current scam is significantly more specific. The mention of an exact amount, for example, is intended to make the email appear more credible and give the impression that it is an actual calculation by the pension insurance.
Also interesting: How North Korean hackers stole several million euros
Additionally, the perpetrators create a sense of urgency by claiming that the refund must be requested or confirmed within a certain period. Otherwise, the claim will expire. In this way, the criminals aim to pressure victims into making hasty decisions.
These Alleged Apple Refunds Are a Scam
Dangerous $8.99 Trick on Amazon
How recipients can recognize the scam
The German Pension Insurance points out in a blog post that it never asks policyholders via email to enter sensitive data or bank details through links. Anyone receiving such a message should be immediately suspicious. Typical warning signs include:
- an impersonal salutation
- a conspicuous or unknown sender address
- the unexpected announcement of a refund
- links or buttons for data entry
- the request to disclose personal information
- artificially created time pressure
What affected individuals should do now
Anyone receiving such an email should not click on the included link or enter any data. Instead, recipients should delete the message or move it to the spam folder. Those needing information about their pension account should only use the official access routes of the German Pension Insurance and enter the web address themselves in the browser, rather than following a link from the email.
If bank details, passwords, or other personal information have already been provided, quick action is recommended. Affected individuals should immediately contact their bank and, if necessary, have cards or online banking access blocked. If passwords have been provided, they should be changed immediately. Experts also advise closely monitoring the affected accounts in the coming days to quickly identify any irregularities.