Social Engineering & FraudMANIPULATIVE

Overpayment Scam

What it is

A fraud in which the scammer "pays" a victim more than an agreed amount with a fake or reversible instrument, then asks for the difference back before the payment is discovered to be worthless.

How it works

The overpayment scam exploits a gap in how banking works: by law banks make deposited funds available within a day or two, but detecting a forged or fraudulent check can take weeks. The scammer sends a check for more than owed (for an item you are selling, a job, rent, or winnings) with a plausible reason for the excess, then urgently asks you to refund the difference by wire, gift card, or crypto. Because your bank shows the money as "available," you believe the funds are real; you send back genuine money, and later the deposited check bounces and the bank reclaims the full amount, leaving you liable. The scam uses your own honesty against you: returning an overpayment feels fair and correct, and the fabricated urgency ("please send it today, I'm traveling") prevents the wait that would expose the check. The FTC has warned about check-overpayment fraud since at least 2004, and modern versions target online sellers, rental applicants, gig workers, and mystery shoppers.

Real-world examples

•A buyer for something you listed online sends a check for well above the price, citing a "shipping agent," and asks you to forward the surplus to the courier.
•A fake employer's onboarding check overpays for home-office equipment and directs the new hire to wire the balance to a specified vendor.
•A prospective renter sends a deposit check for more than the amount due and asks the landlord to return the excess before the check clears.
•A "mystery shopping" assignment sends a check to evaluate a wire-transfer service, with instructions to send most of it and keep a fee.

Ethical guidelines

●Paying with a worthless instrument and demanding real money back is theft; there is no legitimate version.
●A genuine buyer, employer, or tenant has no reason to overpay and route the difference elsewhere; the overpayment itself is the red flag.
●Financial institutions and marketplaces should warn users clearly that available does not mean cleared.

How to defend against it

►Never accept a payment for more than you are owed and refund the difference; decline the overpayment and ask for a corrected amount.
►Understand that funds showing as available can still be reversed for weeks; wait for a check to truly clear before sending anything, and ask your bank if unsure.
►Refuse to send money by wire, gift card, or cryptocurrency to someone who "overpaid" you, especially under time pressure.
►Be suspicious of any deal that involves a third-party "agent," "courier," or vendor you must pay on the other party's behalf.
►Report overpayment and fake-check scams to reportfraud.ftc.gov, and if you have already sent funds, contact your bank immediately.

From the Defense Playbook

Gift Cards Mean Scamseconds

Treat any demand to pay a debt, fine, fee, bail, or "security deposit" with gift cards, cryptocurrency, a wire to a stranger, a payment app, or cash handed to a courier as proof of fraud, because no legitimate institution collects money that way.

Every playbook entry states how strong its evidence is and when not to use it. Browse the full playbook.

References

Federal Trade Commission (2018). Anatomy of a fake check scam. FTC Consumer Advice · link
How the gap between funds availability and check clearing lets overpayment scams work.
Federal Trade Commission (2004). FTC Warns Consumers about Check Overpayment Scams. Federal Trade Commission press release · link
Early official warning describing the overpayment-and-refund structure across selling, work, and rental contexts.

Last reviewed 2026-09-07

Suggest a correction

Detect Overpayment Scam in any text

Paste any message, email, or article into our free Manipulation Detector to see if Overpayment Scam or other techniques are being used on you.

Try the Detector Free Create Free Account

Social Engineering: Why Smart People Fall for It

Social engineering does not target stupidity. It targets helpfulness, deference, and time pressure, which are the same habits that make people good at their jobs. Here is how the attacks are built and which procedures actually stop them.

7 min read

The Disinformation Playbook: How Campaigns Are Built and Where They Break

Disinformation campaigns follow a recognizable sequence: seed, launder, amplify, and let real people carry it the rest of the way. A field guide to the stages, drawn from the research, with the defences that work at each one.

8 min read