The scam has many variants, but all of them include some combination of a fraudulent payment from the scammer to the victim and a legitimate payment from the victim to the scammer.

Check overpayment scam edit

In a check overpayment scam, the scammer will pay the victim for goods or services (often in response to an online or classified advertisement, though there are a number of other premises for check overpayment scams) with a fraudulent check of an amount in excess of the intended amount. In some cases, the scammer will claim that the difference between the intended amount and the amount on the check is due to customs or other import fees, or shipping fees.^[1] The fake check can present either as a personal or cashier's check. The scammer then requests that the victim pay them the excess between the intended amount and the amount on the check.^[2] After the victim does so, they discover that the scammer's check was fraudulent, losing their money. In addition, if the check was sent in response to an online or classified advertisement and the victim has already sent or delivered the item being sold to the scammer, the victim loses their item as well.

The check variant of the overpayment scams, as well as other confidence tricks where scammers send the victim an illegitimate check, work in part because of the delay—sometimes days or weeks—between a customer depositing a check at a bank and the check clearing and being verified as legitimate.^[3]

Online refund scam edit

In an online refund scam, a scammer usually finds potential victims by cold calling phone numbers until there is a responsive victim. The scammer pretends to represent either a well-known large company or a smaller company offering a service of some kind. The scammer tells the victim that the company owes the victim a refund either for a product that the victim supposedly ordered or a service that the company can no longer provide. In a similar version, a scammer impersonating an e-commerce website such as Amazon or eBay tells the victim someone fraudulently ordered an expensive item using the victim's account and offers the victim a refund for the supposed fraudulent transaction. The scammer will request to access the victim's computer using remote desktop software, and then ask the victim to log in to their online banking website. In some cases, the scammer has the victim fill out an online form with the amount that they are supposedly owed, which they later claim the victim filled out incorrectly. The scammer blanks the victim's screen using the remote access software, and uses the web development tools of the victim's browser to temporarily edit the online banking webpage to show a transfer into the victim's account. While no transfer has actually taken place, when the scammer restores the victim's ability to see the screen, the edited version of the webpage may convince them that the scammer did indeed transfer money into their account.^[4]

After the victim believes that a transfer has gone through, they then discover that the amount supposedly transferred into their account is larger than expected. Using the good faith of the victim against themselves, the scammer often claims that their job is at stake if the victim doesn't return the difference between the intended amount and the supposedly paid out amount. In cases where the scammer told the victim to fill out a form, the scammer will claim the victim is responsible for the error, in order to induce guilt. The scammer may also resort to aggressive tactics such as threatening and intimidation to force their victim into complying with their demands. The return is done by wire transfer, money order, or sometimes by store gift card, which the scammer then redeems, making it near impossible for the victim to retrieve their money after being scammed in this way. Some amount of time later, the victim then finds out (possibly by reloading their online banking website, as reloading the page removes the scammer's changes) that the scammer never transferred any money into their account at all, and that any money sent to the scammer has been lost.^[4]

Online refund scams can also be considered a form of technical support scam, as they largely follow the same format of connecting to the user's computer with remote access software. In addition, some online refund scams have been targeted at users who had previously fallen victim to technical support scams, claiming that the company which originally conned the victim had gone out of business and could no longer provide the "security services" the victim paid for in the original scam.^[5]

Business payment account scam edit

A scammer offers to buy an item on an online marketplace such as Facebook Marketplace using Venmo or Zelle. The scammer tells the seller (victim) that to complete the transaction, the seller needs to upgrade their account to a business account. The scammer sends the victim a bogus payment notice for the item's price plus what they claim is a business account upgrade fee, then asks the victim to buy the upgrade from someone impersonating the payment processor so that the victim can receive their payment. The victim does not actually receive any payment, but the scammer receives a fraudulent "upgrade" payment from the victim.^[6][7]

• Kitboga, a Twitch streamer and YouTuber focused on scambaiting, baits online refund scammers.
• Jim Browning (YouTuber), a YouTuber who attempts to stop online versions of refund and other scams by intervening during scam calls.