The Overpayment Refund Scam

Why this matters

The overpayment scam works because refunding a customer who paid too much feels like honesty, and a shop that prides itself on fair dealing wants to send the difference back fast. The scammer pays with something that looks like money and is not yet money, a check or a card that will bounce or be reversed, then asks for the difference back by a method that cannot be reversed. When the original payment fails, the shop has lost the whole refund, and often the work as well. One rule stops nearly all of it, and the rule has two halves: refund only to the original payment method, and only after the original payment has actually cleared.

How it is built

Every version has the same three parts.

1. A payment larger than the bill. A check written for well over the invoice, a card charged for "the whole project plus the next phase", a commercial customer who "accidentally" pays an invoice twice.
2. A plausible story for the excess. An accounting error, a deposit for future work that is now cancelled, a payment meant to cover a mover or a supplier you are asked to pay on their behalf.
3. A request to send the difference by a different method, quickly. Wire it, send it by a payment app, buy gift cards, refund it to "my other card because that one is closed", or pay the third party directly.

Part 3 is the whole scam. Parts 1 and 2 are just the setup that makes part 3 feel reasonable. A legitimate overpayment almost never needs a different method and almost never needs to move today.

How it looks in a service business

The versions that reach trade shops are adapted to how trade shops get paid:

• The mailed check from a property manager or general contractor you have not worked with before, for several times the invoice, followed by an email asking you to refund the difference by wire.
• The job booked by phone or email with a card, overcharged at the customer's own request "to cover the materials my contractor already bought", with the excess to be paid to that contractor. The card is stolen. See related: Card-Not-Present Fraud on Phone Bookings.
• The double payment of a real invoice: a check plus a card, or two checks, then a request to refund one of them to a new account. Sometimes one of the payments is fake; sometimes the request comes from someone who has taken over the customer's email.
• The cancelled project with a large deposit paid by check, cancelled two days later, with the refund wanted "today, by app, because we are closing the account".

Why "the bank said the funds are available" is not clearance

This is the misunderstanding the check version runs on. Under the federal Regulation CC (12 CFR Part 229), banks must make deposited check funds available on a fixed schedule, commonly a first small portion the next business day and most of the rest within about two business days for many checks, with longer holds allowed in some cases. Availability is a deadline on your bank, not a statement that the check is good. The paying bank can still return a counterfeit or altered check after the funds show as available, and the return can take days or weeks to reach you. When it does, your bank reverses the deposit out of your account. If you have already wired the "difference", that money is gone, and your bank is not obliged to cover it. The FTC's fake check guidance makes the same point to consumers and businesses alike: the person who deposited the check is responsible for it when it bounces, however long the bank took to notice.

Electronic payments have their own version. For a consumer ACH debit, Nacha's operating rules let the account holder return an unauthorized debit for up to 60 calendar days after settlement, so an ACH payment taken from a compromised account can unwind long after it posted. A card payment from a stolen card can be disputed for months under card network rules. Each payment rail has a window during which "received" is not yet "kept".

The rule, and why each half is there

Refund only to the original method. A refund on a card goes back to the same card through your processor, which most processors require anyway. A refund on a check is your own check to the payer on the original check, mailed to the address on file. A refund on ACH goes back to the account it came from. The reason: if the original payment was fraudulent, a refund to the original method returns money to the real owner of that card or account, which costs you only the processing, while a refund to anywhere else hands it to the scammer.

Notice what that half does on its own for a card. Refunding the original stolen card puts the money back in the real cardholder's account, which leaves nothing for them to dispute. That makes a same-card refund safe at any time. Every request to send it somewhere else is the scam.

Only after the original payment has cleared. This half matters for checks and bank debits, where you are sending new money out rather than reversing a card charge. A shop default worth starting from: no refund on a check overpayment for at least ten business days after deposit, and not until your bank confirms the check was paid by the bank it was drawn on, rather than merely made available. Ask your bank which status it can confirm; some can tell you the item has been paid, some only that it has not been returned yet, and the difference matters. For a first-time customer's large check, ten business days is a floor, not a target.

A shop that holds only one half of the rule is still exposed. Refunding to the original method too early (writing your own check against a deposit that has not cleared) loses the money when their check bounces. Waiting for clearance but refunding by wire to a new account loses it when the "customer" turns out to be someone in their inbox.

A worked timeline

A new commercial contact emails a request for a fence repair on a rental property. The invoice is sent. Days later a mailed check arrives for 3.2 times the invoice, drawn on a business you do not recognize. Here is how it unfolds when the office handles it on instinct.

DAY 1   Check deposited. Bank app: deposit pending.
DAY 2   Funds partly available.
        Email: "Our AP sent the wrong amount. Please
        wire the difference to our vendor, details
        attached. Need it today for their payroll."
DAY 3   Funds fully available. Office wires 2.2x
        the invoice (3.2x paid less 1.0x owed).
DAY 4   Crew completes the fence repair.
DAY 12  Bank notice: deposited item returned,
        counterfeit. Deposit reversed in full.
DAY 13  Wire recall requested. Receiving bank says
        funds already withdrawn.

Run the arithmetic as multiples of the invoice. The check was for 3.2x. The office wired 3.2 minus 1.0, which is 2.2x, to the "vendor". On day 12 the full 3.2x deposit comes back out of the shop's account. The shop is now down the 2.2x it wired, plus the fence repair it did for nothing, which costs it the labor and material of a 1.0x job. Against an invoice the shop expected to profit on, it has lost more than twice the invoice in cash and done the work free.

Now run it under the rule. The office replies to the email: "We received a payment larger than our invoice. We will refund the difference by check to the payer named on your check, mailed to the address on it, once our bank confirms the check has been paid, which usually takes about two weeks. We cannot send refunds by wire or to a third party." The crew does not schedule the repair until the original invoice amount is collected from a cleared payment. In practice the scammer stops replying the same day, the check comes back on day 12, and the shop's loss is a bank return fee.

What would change the answer. Suppose the overpaying party is a property manager you have invoiced for two years, who has paid by check every month, and who calls from the office number you already have. That is a real error and the risk is low, and you can refund sooner. The rule still holds for the method: your check, to them, at the address you already have. Even with a long-standing customer, a refund request that arrives by email with new bank details is a second, separate red flag, because an email account can be taken over while the relationship is real. See related: The Verify-on-a-Second-Channel Rule.

The scripts the office needs

Most offices lose this money because nobody gave them permission to say no to a customer who sounds upset. Give them the sentences.

• On the overpayment: "We'll refund the extra to the original payment once it's cleared with our bank. That's the only way we can do it."
• On urgency: "I understand it's urgent. Our bank won't let us move it any faster, and we don't send refunds by wire, app or gift card."
• On a third party: "We can only pay our own suppliers. If someone else is owed money for this job, you'll need to pay them directly."
• On a new card or account: "Refunds go back to the card it was charged on. If that card is closed, the card issuer will pass it to your new one."

That last line is true more often than people expect: a card issuer typically routes a refund on a closed or replaced card to the account that replaced it, so "my old card is closed" is rarely a real obstacle.

If the money already went

Call your bank the moment you suspect it and ask for a recall of the wire or payment, then report it to the FBI's Internet Crime Complaint Center (IC3), which is the channel banks and law enforcement use to try to freeze funds at the receiving bank. Speed is everything; recovery chances fall off sharply after the first day or two. File a police report for the record your insurer will want, and check whether your business crime or cyber policy covers social engineering losses, many of which need a specific endorsement. See related: What Cyber Insurance Applications Actually Ask.

References

• Regulation CC, Availability of Funds and Collection of Checks, 12 CFR Part 229
• Nacha Operating Rules, unauthorized consumer debit return timeframe
• FTC consumer and small business guidance on fake check scams
• FBI Internet Crime Complaint Center (IC3) reporting guidance
• See related: Card-Not-Present Fraud on Phone Bookings