In an overpayment scam, a buyer or employer sends more than agreed and asks you to return the difference. The original payment — a cheque, a transfer, an app notification — is fraudulent and reverses days or weeks later, after your refund has gone on a rail that cannot be undone. The loss is the full amount you sent.
You are selling something. A buyer appears who does not haggle, does not want to view it, and agrees immediately. Or you are offered a job — mystery shopper, personal assistant, equipment tester — that pays well and starts at once.
Then the payment arrives, and it is too much. There is always a reason: the buyer’s assistant made an error, the amount includes the shipper’s fee, the employer added the cost of equipment you are to buy from a named supplier. Would you send the difference on?
The payment you received is fraudulent. A cheque that will bounce, a transfer from a compromised account that will be recalled, or a payment-app notification that was simply spoofed. It reverses days or weeks later, and your bank takes the whole amount back. The difference you returned was your own money, sent on a rail that does not reverse.
The instrument is fading. US fake cheque reports fell from 38,451 in 2022 to 13,616 in 2024. The mechanism is not fading: FBI overpayment losses were higher in 2025 than 2024 despite fewer complaints, with loss per complaint rising from about $6,700 to about $10,400.
A buyer who pays the asking price without seeing the item. An employer with no interview. A tenant who will rent unseen. Frictionlessness is the first signal, and it reads as luck.
A cashier’s cheque, a bank transfer, or a payment-app notification. Always more than agreed, always with an explanation that sounds administrative rather than suspicious.
This is the pivot, and it rests on a misunderstanding almost everyone has. “Available” is not “cleared” — your bank has advanced you the money as a convenience, and can reclaim it later.
Rarely back to the sender. To a shipping agent, an assistant, a supplier — or as equipment bought from a named vendor. The redirection is deliberate.
Where it could have stopped
Anyone who overpays you and asks you to return the difference is running a scam, whatever the payment method and whatever the explanation. A genuine overpayment is corrected by the sender reversing it — which requires nothing from you at all, and certainly not a payment on a different rail.
By transfer, gift card, cryptocurrency or cash. All final. Meanwhile the goods may also have been shipped.
Days or weeks later. Cheques can be returned long after funds appeared available; fraudulent transfers get recalled; a spoofed app notification was never money at all.
The bank reclaims the full amount. You are out the difference, the goods, and sometimes an overdraft. If you forwarded funds for someone else, you may also have acted as a money mule.
It exploits a fact about banking almost nobody knows. The gap between “available” and “cleared” is a convenience most people have never had reason to think about, and the entire scam lives inside it.
Nobody is asking you for money. You are being given money and asked to correct an error. Every fraud warning people carry is about the opposite direction, so none of them fires.
Returning it is the honest thing to do. The victim is not being greedy — they are being scrupulous about money that is not theirs. That is a much harder impulse to interrupt than temptation.
The overpayment is explained plausibly. An assistant’s error, a shipping fee, an equipment allowance. Each is the kind of small administrative mess that happens in real transactions.
Speed is disguised as courtesy. The pressure to return the difference quickly is framed as consideration for the other party, not as urgency.
And the redirection passes unnoticed. Sending the difference to a third party rather than back to the payer is the detail that makes no sense on inspection, and it is precisely what the politeness of the exchange discourages inspecting.
Overpayment fraud has no single geography, and this page will not invent one. The enforcement record places much of the English-language volume with West African networks, often the same operations running advance fee and romance schemes — the fraudulent instrument and the recruitment of someone to receive it are the same skill set.
What the case record does show clearly is the connection to mule recruitment. US prosecutors have charged schemes in which elderly romance victims were exploited to serve as unwitting money mules, receiving and forwarding proceeds of other frauds. The overpayment structure is one of the ways that recruitment happens: a person who accepts a payment and forwards part of it has been converted into infrastructure, whether or not they realise.
The instrument has migrated with the payments system. Cashier’s cheques dominated for two decades. Bank transfers from compromised accounts followed. Payment-app notifications are now common, and they are the easiest of all to fake, because the victim is looking at a message rather than a balance.
US fake cheque scam reports to the FTC fell from 38,451 in 2022 to 13,616 in 2024, and FBI overpayment complaints fell from 4,144 in 2023 to 2,194 in 2025. Losses did not fall with them: FBI overpayment losses were higher in 2025 than in 2024. Cheques are fading as an instrument, but the overpayment mechanism they carried has moved onto other rails.
Canadian job-scam losses rose from C$9.5 million in 2021 to C$48.9 million in 2024 — more than five times — while report counts fell. In Australia, Scamwatch job-scam reports rose 102.4% in 2025 and losses jumped 81.5%, from A$13.7 million to A$24.8 million, with the largest increases among people aged 25 to 34 and among First Nations, disabled and culturally diverse reporters.
Purchase scams are the highest-volume fraud in every national dataset that separates them, and they attract the least attention. UK Finance recorded purchase scams as 71% of all authorised push payment cases in 2025, with losses of £118.1 million. The FBI logged 56,478 non-payment and non-delivery complaints and $503.4 million. In Australia, more people reported losing money to shopping scams than to any other type.
On 22 May 2025 Malaysia extradited Kenyan national John Muriuku Wamuigah to stand trial in the District of Connecticut on a wire fraud charge. Prosecutors allege he and others executed a scheme using both business email compromise and romance scams, and that the scheme involved exploiting elderly victims through romance fraud so that they would serve as unwitting money mules.
If a payment has arrived and you have not sent anything back. Do not send it. Do not spend it. Call your bank, tell them you believe the credit is fraudulent, and ask them to hold it. Then stop communicating with the sender — the pressure to return the money quickly will increase, and that pressure is the entire remaining scam.
If the transaction is genuine, nothing is lost by waiting for full clearance. Ask the bank explicitly when the funds are irrevocably cleared, not when they are available.
If you have already sent money back.
Selling safely. Take payment on the platform where the listing lives, so its protections apply. Prefer instant, irrevocable methods you can verify yourself over cheques and app notifications. Wait for full clearance before releasing goods. And treat any transaction that involves money moving back out from you as a stop condition rather than a step.
The difference you return is real money, and it goes where irreversible money goes: a mule account, a money transfer service, gift card codes, or cryptocurrency. Where the refund is sent to a “shipping agent” or “supplier”, that account is controlled by the operation.
The fraudulent instrument that started it is the interesting half. A stolen or counterfeit cashier’s cheque, a transfer pushed from a compromised account, or a spoofed notification costs the operation almost nothing — and if the victim is slow to notice, the operation gets both the refund and the goods.
There is a second product here too. A person who receives money and forwards it has become a mule account in the payment system’s eyes, and that status has value: it can be used again for a different fraud, and the person’s name is the one attached to it.
The other half of this story
Our sibling site Clean on Paper explains why they need you to send the money on — how a single forwarded payment turns an ordinary account into laundering infrastructure.
No agency publishes a line item for most of the schemes on this site, so these charts show the official categories that contain this scheme. Each series is labelled with the agency's own category name. See how the mapping works.
No, and this is the single most costly misunderstanding in this scam. 'Available' means your bank has advanced you the money as a convenience. Clearing happens later, and a fraudulent cheque can be returned weeks afterwards — at which point the bank reclaims the full amount from your account, including whatever you have already sent on.
Not necessarily. Transfers made from a compromised account, or push payments later reported as fraudulent, can be reversed or recalled. Payment-app notifications can also be spoofed outright — the message on your phone is not the same thing as money in your balance.
Because it creates an obligation and a reason to move money in the opposite direction. You now hold funds that are not yours, returning them is the decent thing to do, and your return payment is real and irreversible while theirs is neither.
Because it breaks the connection. Refunding the original payer would look like an ordinary reversal; paying a third party moves your real money to an account they control while the fraudulent payment sits in your name.
Your bank will reverse the fraudulent credit — that is the problem, not the solution. Recovering what you sent depends on how fast you report it and where it went. Call the fraud line the moment you realise, before the reversal lands.
You can be, which is why raising it yourself matters. Receiving and forwarding criminal proceeds is a money-mule offence in most jurisdictions regardless of intent. Report it proactively, keep every message showing what you were told, and expect your account to be reviewed.
Report it
Reporting is what produces the enforcement data on this page. Find the right agency and phone number for your country on the report page. If money moved in the last few hours, call your bank first.