An overpayment scam is a con where the scammer pays with a bad or fake payment, then asks the victim to refund the difference before the original payment bounces. The victim sends real money out against funds that were never good, and is left covering the whole amount once the deposit reverses.
What is an overpayment scam?
An overpayment scam exploits the gap between when a payment looks settled and when it is actually final. A buyer, employer, or tenant sends the victim more than they owe, then invents a reason and asks for the extra back. The refund goes out immediately as real, cleared money. Days later the original payment fails, is reversed, or is exposed as fraudulent, and the victim is on the hook for both the goods and the refund.
The scam leans on instruments that credit fast but clear slowly: paper checks, mobile check deposits, and some payment-app or card transactions that can be reversed after the fact. The victim sees a positive balance and assumes the money is theirs. It is not, and by the time the bank claws it back, the refund is long gone.
For fraud teams this is a classic first-party exposure with a social-engineering front. The victim authorizes the outbound refund willingly, so it is not an account takeover. The loss lands wherever the returned item settles, which is usually the victim and their bank.
How an overpayment scam unfolds
The trick is always the same: seed a fake credit, then rush a real payout before it unwinds.
- SetupCreate a reason to pay The scammer buys an item, hires the victim, or rents a place, then agrees a price.
- OverpaySend too much, on purpose They pay with a check or reversible transfer for more than owed, blaming a typo, a fee, or a mover.
- RushDemand the difference back Before the deposit clears, they pressure the victim to refund the surplus by wire, gift card, or crypto.
- ReverseThe original bounces The check or transfer fails, the bank reverses the credit, and the victim loses the full refunded amount.
Who is involved?
Who | Their role |
The scammer | Poses as a buyer, employer, or tenant, sends the bad overpayment, and collects the real refund. |
The victim | A seller, jobseeker, or landlord who deposits the payment and refunds the difference in good faith. |
The receiving mule or wallet | The destination for the refund, often a new account, gift-card code, or crypto address. |
The victim's bank | Grants provisional credit, then reverses it when the item returns, absorbing or chasing the shortfall. |
What it looks like in practice
A seller lists furniture online. A buyer offers full price and sends a check for a much larger sum, explaining that it accidentally includes the mover's fee and asking the seller to forward the mover's share by wire once the check lands. The deposit shows as available the next morning.
The seller, seeing the balance, wires the mover's share to the number the buyer provided. Four days later the check is returned as counterfeit, the bank pulls back the full deposit, and the seller is left owing the wired amount with no furniture sold and no way to recover the funds.
Why it matters for operators
Overpayment scams turn a bank's own funds-availability policy into the weapon. Regulations require quick access to deposited funds, but availability is not the same as final settlement, and scammers live in that window. The customer genuinely believes the money is good because the app told them so.
The result is a loss that looks self-inflicted but is really the tail end of a scam. Catching it means spotting the shape early: a large inbound check or reversible credit, immediately followed by an outbound irreversible payment to a different party. That inbound-then-outbound mismatch, on a fresh relationship, is the tell that matters more than any single transaction on its own.
What to watch in the data
- Deposit then dispatch. A large check or reversible credit followed within days by an outbound wire, gift card, or crypto payment for a smaller amount.
- Mismatched parties. Money comes in from one name and the refund goes out to a different, unrelated recipient the customer just met.
- Round surplus with a story. An overpayment justified by a mover, an agent fee, or a clerical error, always with pressure to return the extra fast.
- New account, big first deposit. A recently opened account whose very first large credit is a check that clears slowly.
- Provisional-credit spend. Outbound transfers that draw down balance still tied to an uncleared deposit.
Quick questions
Why does the bank show the money as available if it is not final?
Funds-availability rules require banks to release deposited funds quickly, often within a day or two. That provisional credit is not the same as final settlement, and a check can be returned as bad well after the funds appear spendable.
What payment types are most exposed?
Paper and mobile-deposited checks are the classics because they can be returned weeks later. Some card and payment-app transactions also qualify when the original credit can be reversed or disputed after the refund goes out.
Is the victim liable for the loss?
Usually yes. Because the victim authorized the outbound refund and deposited the bad item, the returned deposit is charged back to them, and the refunded money is gone.
How is this different from a purchase scam?
In a purchase scam the victim pays for goods that never arrive. In an overpayment scam the victim receives a payment first, then loses money by refunding a surplus against funds that were never real.
What warning should staff give customers?
Never send money back against a deposit until it has truly cleared, and treat any request to refund an overpayment by wire, gift card, or crypto as a strong sign of a scam.
Where should the intervention happen?
At the outbound payment. Holding or questioning the irreversible refund, while the uncleared deposit is still in flight, is the point where the loss can still be stopped.
O que saber junto com Overpayment scam
Relatório de Fraude e AML 2026
Esqueça as previsões. Este relatório detalha com o que as equipes de fraude e AML estão realmente lidando, e como responder.