Seller-Targeted Scams (Fake Payment and Overpayment)
Scams aimed at sellers, such as fake payment confirmations, overpayment and refund-the-difference schemes, off-platform payment lures and verification-code requests, that make sellers ship goods or send money.
What it is
Most marketplace fraud content is about protecting buyers. Seller-targeted scams flip that around. The victim is the seller, usually an individual or small merchant on a peer-to-peer platform, and the scam exploits the gap between the appearance of payment and its finality.
The FTC warned sellers on online marketplaces in July 2022 about three patterns. First, fake payment notifications from "buyers" who insist on mobile payment apps, often with a claim they overpaid and need a refund. Second, fake check overpayments, where the seller deposits a check for more than the price and sends back the difference. Third, verification-code scams, where a "buyer" asks for a code sent to the seller's phone to hijack their number for other scams. The FTC's warning on checks describes the core mechanic. Banks make deposited funds available quickly, but can take weeks to find a check is fake, and then claw the money back from the victim.
The overpayment pattern is decades old (the FTC described it to sellers in 2004 and 2006) and remains measurable. The FBI's IC3 recorded 2,194 overpayment complaints and about $22.9 million in losses in 2025. Many seller scams are categorized elsewhere (non-payment, advance fee), so the true number is larger.
How it works
Conceptual families:
| Family | What the seller sees | What's actually happening |
|---|---|---|
| Fake payment confirmation | Email, text or screenshot saying payment is "pending" or "held until shipping" | No payment exists; the notice is a forgery or an Impersonation Scams lure |
| Overpayment and refund-the-difference | A check or transfer for more than the price, with a request to return the excess | The inbound instrument is counterfeit, stolen or reversible (Check and Mobile Deposit Fraud, ACH Funding Fraud) |
| Off-platform steering | Buyer asks to pay or chat outside the marketplace | Removes platform protection and monitoring |
| "Upgrade" or fee scams | Seller told to pay a fee to "release" a payment or upgrade an account | Advance-fee scam aimed at the seller |
| Verification-code harvesting | "Buyer" asks for a code sent to the seller's phone | Seller's number or account is hijacked for other scams |
| Fake shipping or courier pickup | Buyer arranges their own "courier" | Goods collected before payment fails |
| Phishing "payment" links | Link to "receive payment" that captures credentials or card data | Leads into Phishing and Credential Harvesting and ATO |
Transaction footprint
The seller's bank, P2P provider or neobank is often the best-placed defender. The scam produces a recognizable funding-then-outbound sequence.
| Stage | What you see in the data | Decision point |
|---|---|---|
| Inbound | Check or transfer deposit from an unfamiliar source, often for an odd amount above typical inflows | Apply Funds Availability Holds proportionate to instrument risk |
| Provisional availability | Funds shown as available before final | Clearly distinguish "available" from "final" in the UI |
| Outbound | Shortly after deposit, an outbound P2P, wire, gift card or crypto purchase for roughly the "overpayment" amount to a new payee | Real-time scam scoring; Payee Confirmation and Payment Friction; contextual warning |
| Return | Deposited item returned or transfer reversed | Seller's account goes negative; loss realized |
| Recurrence | Victim's account later receives other victims' funds (mule recruitment) | Money Mules detection |
On the marketplace side:
| Stage | What you see | Decision point |
|---|---|---|
| Messaging | Off-platform contact requests, payment-app insistence, overpayment language, urgency | In-chat warnings; message classification |
| Account | Buyer account new; contact details risky | Restrict messaging or listings interaction |
| Transaction | No on-platform payment recorded despite a "sale" | Educate sellers that only on-platform payment counts |
Common variants
| Variant | Rails | Notes |
|---|---|---|
| Counterfeit check overpayment | Check and Mobile Deposit Fraud → P2P, wire, gift card | Classic; exploits funds availability |
| Reversible transfer overpayment | ACH, card-funded P2P → irrevocable outbound | Inbound reversal after outbound sent (Real-Time Payment Rail Fraud) |
| Fake P2P "pending" notice | None inbound; goods shipped | Pure deception; forged notifications |
| Business or "upgrade" account fee | P2P, gift card | Seller pays to "receive" a payment |
| Verification-code takeover | Phone and account systems | Enables later scams in the seller's name |
| Wrong-item or SNAD scam against seller | Platform refund | Overlaps Buyer Protection Claim Abuse (INR and SNAD) |
Where it shows up
- Peer-to-peer Online Marketplaces and classifieds: the classic venue; individual sellers lack fraud expertise.
- Payments and P2P: fake notifications impersonate P2P apps, and outbound refunds go over irrevocable P2P.
- Neobanks and Consumer Fintech and banks: the deposit and outbound legs; scam victims' accounts may later be used as mules.
- Retail and Ecommerce: small online merchants receiving bulk "orders" with overpayment.
- Cross-industry pattern: overpayment is the seller-side version of the provisional-funds problem in Instant Funding Abuse (Kiting) and Check and Mobile Deposit Fraud. In all three, provisional value shouldn't fund irrevocable outflows without friction.
Impact
- Seller loss: goods plus real money sent out, plus fees and possible negative balances.
- Bank and provider loss where reimbursement policies or regulation shift liability (see Regulation E and Unauthorized Transfers for the authorized-vs.-unauthorized distinction).
- Mule-network growth: victims who once moved "overpayments" get recruited, wittingly or not, to move other funds (Money Mules).
- Platform trust: sellers leave platforms where they feel exposed.
- Scale signals: IC3 2025 overpayment complaints (2,194; ~$22.9M) and advance-fee complaints (7,762; ~$155.9M), both undercounts of seller-specific harm.
Red flags
- Buyer insists on off-platform contact or payment; urgency; can't meet locally → Customer Contact Signals
- "Payment" notices arriving by email or text instead of in-app → Email Risk Signals, Phone Risk Signals
- Deposit for more than the agreed price, followed by a request to send the difference → Scam Victim Indicators
- Outbound payment to a new payee shortly after an unusual inbound deposit → Fast In Fast Out Patterns, Payee and Counterparty Risk
- Unusual inbound source for this customer → Funding Source Signals, Customer Tenure and History
- Requests for verification codes from a "buyer" → classic takeover precursor
Prevention and detection at a glance
| Layer | Control or signal | What it does here |
|---|---|---|
| Prevent | Customer Education and Scam Warnings | Marketplace and bank warnings at the moment of risk (off-platform request, deposit-then-send) |
| Prevent | Funds Availability Holds | Risk-based availability on checks and reversible inbound |
| Prevent | Clear "available vs. final" messaging | Reduces the false confidence scammers rely on |
| Detect | Real-Time Transaction Risk Scoring | Deposit-then-outbound scam pattern at the seller's bank or P2P provider |
| Detect | Marketplace message classification | Flags overpayment and off-platform language |
| Respond | Payee Confirmation and Payment Friction | Contextual friction and delays on risky outbound payments |
| Respond | Customer Support Verification Protocols | Support recognizes and interrupts scams in progress |
Emerging variants and adversary adaptation
- Generative tools make fake payment confirmations, screenshots and "official" emails easy to produce. Sellers can't be expected to spot them, so verification has to happen in-app ("only trust what you see in your account") (Generative AI and Deepfake Fraud).
- Real-time outbound payments shrink the window between the scam and the irrevocable loss. Inbound reversibility and outbound finality form the asymmetry scammers exploit (Real-Time Payment Rail Fraud).
- As marketplaces flag off-platform language, scammers move to images, coded language and multi-step conversations. Combine message signals with financial-side detection at the seller's bank.
- Scam reimbursement frameworks are changing (see Case Study - UK APP Scam Reimbursement Rules (2024) and Case Study - Zelle Scam Liability Disputes (2024-2025)), which raises financial institutions' incentive to detect seller-side scams.
Related mechanisms
- Authorized Push Payment (APP) Scams: the umbrella for deceived outbound payments
- Check and Mobile Deposit Fraud: counterfeit checks in overpayment scams
- Impersonation Scams: fake platform or payment-provider messages
- Money Mules: victims recruited as mules
- Gift Card Fraud: a common outbound rail
- Buyer Protection Claim Abuse (INR and SNAD): buyer-side abuse of sellers through the claims system
Real-world examples
- The FTC's 2022 consumer alert for online sellers describing fake payment notifications, fake check overpayments and verification-code scams.
- The FTC's earlier warnings on check overpayment: 2004 for classified and auction sellers, and 2006 with the National Consumers League. The same pattern still works two decades later.
Sources and further reading
- Selling stuff online? Here's how to avoid a scam (FTC Consumer Alert, Jul 2022): fake payments, overpayment checks, verification-code scams; seller advice
- FTC warns sellers about check overpayment scams (FTC, 2004): classic overpayment mechanics and seller guidance
- FTC and NCL on check overpayment scams (FTC, 2006): overpayment variants; "no legitimate reason" to wire money back
- FBI IC3 2025 Internet Crime Report (PDF): overpayment and advance-fee complaint and loss figures
- Scammers are victimizing people who sell things online (ConsumerAffairs, Aug 2022): summary of FTC warning; cleared vs. good check