Warning: Refund Scam Targeting Small Businesses and a Nod to Jesse James
If you run a small business, an online store, or offer creative services, you’re a prime target for refund scams — even if you don’t sell anything directly.
Recently, I received a strange email asking about a mysterious billing charge. At first, it seemed like a typical scam attempt. But the deeper I looked, the stranger it got — including a reference to the famous outlaw Jesse James (misspelled, no less).
In this post, I’m sharing the full story, what I uncovered about the domain involved (serolik.com), and how you can recognize refund scams before they catch you off guard.
How the Scam Started
On January 23, 2025, I received an email from a suspicious-looking Hotmail address:
st0mmo9otlh6@hotmail.com.
The message was polite and formal, asking for help regarding a supposed billing item they couldn’t remember placing. Here’s a sample of what it said:
Hi there,
I hope this email finds you doing well. I’m contacting you to seek clarification on a billing item that appeared on my banking statement. I would appreciate your assistance in looking into it.
At first glance, it sounded almost legitimate — except for one major problem:
I didn’t have anything for sale on my website at that time.
There was no possible way a legitimate charge could have occurred.
Still, I decided to play along cautiously to see what the scammer was up to — and to better inform you about how these scams operate.
The Strange Shift to Serolik.com
When I replied, I expected to hear back from the same Hotmail account.
Instead, the next email came from a completely different address: j_james@serolik.com.
The reply claimed to be from the same person — but there was no explanation for the change. The sender signed off on both emails as “Jessy James” — an obvious misspelling of the infamous Wild West outlaw Jesse James.
It gets weirder. I went back and checked my sent folder to confirm what happened — and that’s when I realized the Hotmail address must have been a mask or decoy. My reply had actually gone to j_james@serolik.com. Seems like the scammer’s email masking technique wasn’t working properly.
These strange details made the email feel almost cartoonish — but it also hinted that whoever was behind it might not have been very sophisticated.
It was sloppy. It was suspicious. But it was still trying to look just legitimate enough to fool someone who wasn’t paying close attention.
The Dangerous Link
The scammer included a “bank statement” — but instead of attaching a real document, they sent a Google Sites link supposedly leading to a PDF titled “statement_dec_2024.pdf.”
Sent with Google Pixelbook Go:
[suspicious link]
Of course, I didn’t click it. Clicking links like these can often install:
Malware or spyware
Ransomware encrypting your computer
Fake login forms stealing passwords
The goal was clear: get me to click and compromise my device or information.
What I Found Out About Serolik.com
So… What Is Serolik.com?
After investigating, here’s what I found out about serolik.com:
It’s an inactive, parked domain — no real website, just a placeholder page.
It was registered in November 2024 — only two months before the scam email was sent.
It has no known association with any real company or service.
It has no real email infrastructure — no proper mail servers set up.
Interestingly, security researchers noted that around January 2025, serolik.com popped up briefly in reports — but mostly as part of small phishing tests or isolated incidents. As of February 2025, it appears to be clear of phishing activity.
There’s no evidence that serolik.com was part of a massive scam campaign or phishing ring.
It seems more like a domain someone quickly set up (or borrowed) for a short-lived scam run.
Key Red Flags That Gave It Away
Here’s what made me immediately suspicious and why:
- Hotmail address unexpectedly switching to a custom domain: Indicates deception or poor setup
- Fake name referencing Jesse James: Using a “famous” but misspelled name is classic scam behavior
- Asking about refunds when no sales occurred: No legitimate basis for their claim
- External Google Sites link instead of an attachment: Trick to bypass virus scanning and deliver malware
- Brand new, unknown domain (serolik.com): Fresh domains are often a big warning sign
Why Refund Scams Are So Dangerous
Refund scams prey on your desire to do the right thing — to help a concerned “customer” or quickly resolve a misunderstanding.
They often target small businesses, independent artists, and freelancers, because scammers know:
You might not have a huge billing department.
You might personally manage customer communication.
You’ll want to protect your reputation.
Even if the scam looks rushed or poorly written, they only need one click to succeed. There are steps you can take if you clicked on a link form a scam email to get those digital outlaws out of your devices and information.
Final Thoughts — And a Nod to "Jessy" James
The scammer behind this email didn’t ride into town on horseback like the real Jesse James — but their weapon was just as dangerous: social engineering.
By impersonating a concerned customer and creating a false sense of urgency, they tried to lure me into making a mistake.
It’s a good reminder that in the digital Wild West, today’s outlaws don’t wear cowboy hats — they hide behind new domains, fake names, and clever phishing tricks.
If you ever receive an email like this:
Trust your instincts.
Investigate carefully.
And never click a suspicious link without verifying first.
Stay safe out there — and watch out for outlaws, digital or otherwise!
More From Art and Design By Teresa Cowley
0 Comments