Previous:

Episode 04: Refund + Overpayment Scams

`Research Binder: the receipts (citations + source notes) are compiled in a PDF at the bottom of this article.`

Cold Open

When Being Helpful Becomes the Liability

Your phone buzzes.

“Hey, I sent too much. Can you send it back today?”

Your bank app shows the money. It even says “available.”

Everything in your body says: be decent, be fast, fix it.

That instinct is the trap.

Refund and overpayment scams do not rely on hacking you. They rely on recruiting your helpful reflex before you verify what is true. The cruel part is that the scam often looks like the moral choice.

If this happened to you already, I’m sorry. Shame is a feature of these scams, not a side effect. This dispatch is here to replace shame with a calm process that keeps you safe and helps you protect the people you care about.

If a “refund” request shows up while the credit is still reversible, you are standing on the trapdoor

Subscribe now

What you will be able to do in 10 minutes

By the end of this episode, you will know the exact moment this scam clicks into place, understand why your bank’s own language gets used against you, and be able to run a first-hour protocol that prevents the double-loss. You will have a branching escalation script for your bank or app, the one vocabulary distinction that changes every outcome, and a Field Kit you can use, share, and hand to someone who needs it today.

recognize the pattern the moment you see it
understand the phrase scammers love: “funds available”
run a first-hour protocol that prevents the double-loss
use a branching escalation script with your bank or app, including the credibility lever that matters most: a case number

This is written for people who want to do the right thing. The scam counts on that. The fix is not suspicion. The fix is a simple process.

One rule to anchor everything

Do not refund. Verify “cleared” first.

The trap in plain English (“The Switch”)

Helpfulness feels like safety. Speed feels like competence. In this scam, speed is the liability. The original payment can reverse. The refund you send is usually final. That asymmetry is the whole game.

Picture the two-lane timeline. In one lane, their original payment moves toward your account but has not settled. In the other lane, your refund moves out and lands immediately on a rail they control. The scam’s goal is not to convince you that you are wrong. The goal is to get your money moving before the original credit finishes clearing.

This is “The Switch”. The moment the conversation stops being about a simple mistake and starts being about your money moving through a door that will not reopen. Most people do not feel The Switch happening. That is the design.

They show you “money,” then rush you into sending clean money, then the original credit disappears like it was never there

Once you see the two-lane timeline, you stop negotiating with your instincts. The scam’s goal is not to convince you you’re wrong. The scam’s goal is to get you to move your money onto a rail they control before the original credit settles.

Breakpoints present in this scam

Click to Catastrophe is the pattern map I use to label where a scam tries to force a bad decision. Breakpoints are the specific moments in a scam where defenses fail and a single intervention changes the outcome.

This episode activates three:

Money Movement: they push you to send a new payment
Escalation Pressure: urgency and countdown language override caution
Shame and Silence: embarrassment delays reporting and makes losses worse

If you can stop the money from moving, you win.

How it spreads

This scam spreads the way most social engineering does: not by being sophisticated, but by being ordinary. The wrapper changes. The pressure script stays the same.

The P2P explosion gave it new oxygen

Venmo, Zelle, Cash App, and PayPal Friends and Family moved money faster than any previous consumer payment rail, and moved it with almost no friction, no float, and no reverse gear. That combination is not a bug scammers exploit occasionally. It is the environment they operate in permanently. When a stranger “accidentally” sends you $300 and urgently needs it back, they are not counting on you being greedy. They are counting on you being decent, and on the app confirming “funds available” before the originating payment has actually cleared.

Marketplaces handed it a cover story

On Facebook Marketplace, Craigslist, and eBay, the overpayment scam has been running for over a decade in check form and simply migrated to digital rails when the population did. A buyer “overpays” for your used furniture. They apologize. They ask you to refund the difference before pickup. The platform creates an implied legitimacy, this is a transaction not a con, that lowers the guard of people who would otherwise trust their instincts.

Checks brought it into the bank lobby

Mobile deposit capture is one of the genuine quality-of-life improvements in consumer banking. It also created a window scammers have used systematically since the feature launched. A check can show as “available” in your balance while the bank is still determining whether it will actually clear. That window can be 24 to 72 hours. The “your app shows it” line is not a misunderstanding. It is a trained pressure phrase designed to use your own bank’s interface against you.

Business accounts are not immune. They are targets.

The overpayment mechanic appears in vendor relationships, customer refund queues, and payroll corrections. An “overpaid” invoice, a “duplicate” ACH, a “wrong amount” contractor payment: all are vectors for the same reversal play. Someone in AP who does not want to be the person who held up a vendor relationship is exactly the person this pressure is designed to reach.

The emotional architecture is the distribution channel

Scammers do not advertise. They send volume, and they wait for the combination of an unexpected credit, a polite request, and a person who does not want to seem unhelpful. The scam spreads through ordinary human decency, which is also why shame follows it so reliably. Being helpful is not the mistake. The mistake is being helpful before verifying what is actually true.

If a message contains time pressure and a refund request, treat it as a risk event, not a courtesy event.

Complaints and losses are recorded year over year, which means we can stop arguing about whether it is “real” and move directly to “how do we not lose money”

This is tracked, not anecdotal

Three data sources frame the scale, each measuring a different slice of the same mechanism.

IC3 tracks overpayment as a named category:

2024: 2,705 complaints and $21.45M in losses
2023: 4,144 complaints and $28.0M in losses
2022: 6,183 complaints and $38.3M in losses

The category shrinks in complaint volume as detection improves. The mechanism stays. The scripts evolve. The loss-per-incident remains real.

The FTC’s fake-check category, which overlaps with this mechanic’s “refund then reverse” core, reports a median personal loss of $1,900 and $138M in total losses in 2023 across 32,164 reports, with 34% of those reporting a dollar loss.

A polite refund request can turn into a four-figure loss inside an afternoon.

Median loss per incident: $1,900. Not “in theory.” Not “if you are careless.” Just one polite request plus one fast refund

What it actually costs

Here is a scenario that is not hypothetical. It is a composite of documented cases, assembled to show the full shape of the loss.

Sandra is 71. She sold her late husband’s woodworking equipment on Facebook Marketplace: a table saw, a router, some clamps. She priced everything carefully and felt good about it. A buyer reached out quickly, said he was a contractor who needed the tools for a job starting Monday. He offered full asking price without negotiating.

The payment came through before they had even confirmed pickup. Sandra saw it in her account: $1,850 available. Then a follow-up message arrived: “So sorry, I sent $1,850 but I meant to send $850. My wife is going to be furious. Can you please Zelle me back the $1,000 difference? I can still come Tuesday.”

Sandra did not want to make his home situation worse. She sent the $1,000 back. He never came for the tools.

Three days later, the original $1,850 reversed. It had been funded through a stolen bank account. The “available” balance was a float, not a settlement. Sandra was now $1,000 out of pocket on top of the $1,850 she never actually received. Her bank confirmed the reversal was legitimate and told her the Zelle transfer she had sent was irreversible.

Net loss: $2,850 from a sale she thought would net $850.

The tools are still in the garage.

She did not report it for eleven days because she was convinced the bank would think she had been careless. When she finally called, her daughter was sitting next to her. The bank opened a case. The funds were long gone.

The IC3 elder fraud data puts a number to what Sandra’s situation represents: 1,183 overpayment complaints from victims over 60 in a single reporting year, with $10.98M in combined losses. That averages roughly $9,280 per older victim. Not a rounding error. A piece of a fixed income, a savings account that took years to build, a buffer that does not grow back.

A practical way to help someone older in your life: send them one sentence before they need it.

“If you ever get a credit you weren’t expecting and someone asks you to send money back, stop and call me first.”

Available is a preview. Cleared is permission

Share

That interruption breaks the scam’s most valuable asset: isolation plus urgency. You do not need to explain the whole mechanism. You just need to be the person they call.

Overpayment Scams: $21.45M Lost, 2,705…

Keep reading with a 7-day free trial