Overpayment Scam

An overpayment scam is a fraud in which the target receives a payment for more than they are owed and is asked to return the excess. The payment is worthless, the return is real, and the difference is the whole of the operator's profit.

The two federal descriptions are worth putting side by side, because each captures a version of it. The FBI's Internet Crime Complaint Center defines its Overpayment crime type as a case where "an individual is sent a payment/commission and is instructed to keep a portion of the payment and send the remainder to another individual or business", which is the employment-shaped version. The Federal Trade Commission lists "Overpayments" among the pretexts used in fake check scams and describes the sales-shaped version: people "buying something from you online, 'accidentally' send a check for too much, and ask you to refund the balance."

Both are the same machine. Something arrives that has the appearance of money; something real leaves. Everything else about the scheme, the reason for the overpayment, the identity of the sender, the story about who the balance belongs to, is interchangeable set dressing.

This page is about that machine. Why funds can appear in an account and later be taken back is a question about how deposits actually work, and our guide to cash flow and our page on the cashier's check cover it.

Why the instrument is the part they invest in. A personal check from a stranger invites suspicion. A cashier's check, an official check or a money order does not, because those instruments are understood to be backed by an institution rather than by the person handing them over. That perception is exactly what is being bought. The FTC's own description of why fake checks work is blunt: they "generally look just like real checks, even to bank employees. They are often printed with the names and addresses of legitimate financial institutions. They may even be real checks written on bank accounts that belong to someone whose identity has been stolen." The last of those is worth pausing on, because such a check is not a forgery at all in the ordinary sense; it is a genuine instrument drawn on an account its owner never authorized.

Why the refund is always demanded on a rail that cannot be recalled. The return leg is where the operator's money actually comes from, so it is the leg they control most tightly. The FTC's instruction is never to use money from a check to send gift cards, money orders or cryptocurrency, or to wire money to anyone who asks. It records what those demands look like in practice: the PIN numbers read off the back of the gift cards, or a transfer through a service like Western Union or MoneyGram. Its explanation of the choice is the useful part, that once you have paid this way "it's like you've given them cash. It's almost impossible to get it back." Notice the asymmetry the scheme is built on: the money coming in travels on the slowest, most reversible rail in the payment system, and the money going out travels on the fastest and least reversible one.

Where the victim ends up, which is worse than "did not profit". The bank that made the funds available advances its own money, and when the item is returned it recovers the full face amount from the account. The person in the middle has already sent a large part of that amount to someone unreachable. So the loss is not the difference between what arrived and what was owed. It is the entire amount forwarded, and if the account did not hold enough to absorb the reversal, it becomes a negative balance the customer owes the bank. Anyone who also shipped goods, delivered a service, or paid a supposed third party is out those as well.

The pretext is not the scheme, and the FTC's own list makes that concrete. It names five: mystery shopping, in which the "first assignment" is to evaluate a store selling gift cards or wire transfers; personal assistant work, where the check funds gift cards whose PINs are sent to the "boss"; car wrap advertising, where money is forwarded to "decal installers" who do not exist; claiming a prize, where a check covers the "taxes" you are then asked to pay; and overpayment on an online sale. A page that memorizes those five has learned nothing transferable, because a sixth will exist by the time it is read. What transfers is the structure: an unexpected instrument, a reason part of it belongs to someone else, and a demand for the return in a form that cannot be undone.

The same shape without any paper at all. The refund version of the tech support scam runs the identical arithmetic on a screen the operator controls: no money is credited, an "error in the amount" is announced, and the victim is asked to return the excess. Recognizing the shape is what generalizes; recognizing the check is not.

Where the boundaries fall, because two of them carry criminal exposure. Being asked to receive money and pass it on, or to receive packages and reship them, is money mule conduct, and it has consequences for the person in the middle that go beyond the loss. Instruments stolen, forged or altered against your own account are check fraud, which is a different crime with different remedies. Both are covered on their own pages here.

Scale, dated and attributed. In the FBI's 2025 Internet Crime Report the Overpayment crime type drew 2,194 complaints and $22,898,075 in reported losses. That is a small total beside the impersonation and advance-fee categories, and it is the wrong way to read it: divide one by the other and the per-complaint figure is around $10,400, which is not small at all for the household it lands on. Of those, 477 complaints and $8,045,862 in losses came from complainants aged 60 and over.

The sequence, and each step is load-bearing.

1. Contact with a reason for a payment, whether a purchase, a hire, an assignment or a prize.
2. An instrument arrives for too much, usually one that carries institutional authority: a cashier's check, an official check or a money order.
3. An explanation for the excess. A shipper to be paid, an assistant's expenses, an error by an accounts department, taxes on a prize. It is always someone else's money that has landed in your account by accident.
4. A request to return the balance quickly, on a rail chosen so the transfer cannot be recalled, and usually with a reason the delay would be a problem.
5. The item is returned, days or weeks later, and the bank recovers the face amount from the account.

A hypothetical example, and the arithmetic is the whole lesson. Marisol sells a bicycle online for $400. The buyer sends a cashier's check for $1,900, saying their shipping company has to be paid out of the same check, and asks her to send $1,500 on to the shipper. She deposits the check, sees the funds, and sends the $1,500 through a payment app.

Follow the balance. The deposit puts her $1,900 up. Sending $1,500 leaves her $400 ahead, which is exactly the price of the bicycle, so at this point everything looks correct. Three weeks later the check is returned and the bank debits the full $1,900, taking her to minus $1,500 ($400 less $1,900).

Her loss is $1,500, which is precisely the amount she forwarded and has nothing to do with the $400 she was owed. If her balance had been under $1,500 when the reversal landed, she would owe the bank the shortfall. And if she had already shipped the bicycle, she would be out the bicycle too. The general rule the arithmetic produces is short: in an overpayment scam, you lose what you send on, not what you were promised.

An overpayment scam has no upside, so what follows is what prevents it and what the usual reassurances do not reach.

What genuinely prevents it

• Refusing the overpayment itself. There is no legitimate reason for a stranger to send you more than they owe and ask for the balance back, and declining the payment ends the scheme before any question about the instrument arises.
• Treating an instruction to forward part of a payment as the whole finding, whatever the pretext. The FTC's version is that no honest employer sends you a check and tells you to send part of the money on.
• Never using money from a deposited item to buy gift cards, send a wire, buy cryptocurrency or make an app transfer for someone else.
• Being paid for what you sold, in the amount you agreed, by a method you chose.
• Reporting immediately if money has already gone, because a payment that has not settled can occasionally be stopped and almost nothing can be done after.

What the protections do not reach

• The appearance of the funds in your account, which reflects a deadline the bank has to meet and not a conclusion about the item.
• The instrument's appearance, which the FTC says can convince bank employees.
• A payment you sent yourself, which sits on the authorized side of the line federal electronic-transfer rules draw.
• Gift card codes, wires and cryptocurrency, which have no reversal mechanism once sent.
• Your own position with the bank, which is owed the face amount regardless of what you were told or by whom.