Ilia Zavialov fraud guide: a customer overpays and wants the difference back. When the money is really yours and where refunds go

01

Ilia Zavialov fraud guide: how the overpay-and-refund scheme works

Ilia Zavialov, a digital security consultant for small teams, treats this scheme separately from phishing and payment redirection. Nobody breaks into an inbox or steals a password. The scammer relies on two things every small business has: a wish to look fair to customers, and a gap between the moment money appears in the account and the moment it is truly collected.

The pattern repeats. Money arrives, or something that looks like money. A request follows to send part of it back, quickly and by a different route. Later the first payment turns out to be fake, reversed or someone else's. The refund, though, came out of the company's own funds and it is gone.

The FBI's Internet Crime Complaint Center has a category for it. IC3 defines overpayment as a scheme in which a person is sent a payment or commission and told to keep a portion and send the rest to another individual or business.

Online stores, service firms that take deposits, tutors, childcare providers, landlords and event vendors see it most. The more payments come in each day and the fewer people reconcile them, the easier one 'mistake' of a few hundred dollars slips through.

There is also a timing reason the scheme works. A deposit alert reaches a phone in seconds, while the bank account gets reconciled once a day or once a week. The scammer calls inside that window, while the owner sees only the alert, and asks to 'sort it out now while I'm on the line'. A written policy closes the window.

02

Four versions small businesses run into

Version one is the fake check. A buyer sends a check for more than the invoice and asks for the difference by wire, gift card or payment app. The FTC describes it in almost those words: a person you don't know asks you to deposit a check, usually for more than they owe, sometimes for several thousand dollars, and to send some back.

Version two is the 'accidental' transfer. Real money lands by ACH, Zelle or another app, then a message asks to return the extra to a different account. Version three is the reversal: the incoming payment is disputed or recalled after the business has already refunded the difference.

Version four uses a stolen card. A large order goes through, then the buyer cancels part of it and asks for the refund on a different card because the first one was 'blocked'. In June 2026 the FTC warned childcare providers about 'parents' who overpay by check and ask for the difference by wire or payment app; the check later bounces and the provider repays the bank.

The short video below covers the same ground in half a minute: a check that bounces after it clears on screen, an 'accidental' transfer, a refund to someone else's card, and the rule that stops all of them. Under Regulation CC a local check only has to be available by the second business day, and the FTC warns it can take weeks for a bank to spot a fake, so an available balance proves nothing.

03

Ilia Zavialov fraud check: when deposited money is really yours

Federal funds availability rules explain why the balance misleads. Under Regulation CC, 12 CFR 229.10, a bank must make money from an electronic payment available by the business day after the banking day it receives it, and the first $275 of a day's ordinary check deposits must be available the next business day.

For the rest, 12 CFR 229.12 sets the schedule: funds from a local check by the second business day after deposit, from a nonlocal check by the fifth. Availability means the bank lets you withdraw. It says nothing about whether the bank the check was drawn on has actually paid it.

The FTC puts it plainly. By law banks have to make deposited funds available quickly, and seeing the funds in your account doesn't mean the check is good. It can take weeks for a bank to figure out that a check is fake, and by then the scammer has the money you sent and you are stuck paying it back to the bank.

Ilia Zavialov fraud advice comes down to one line in the bookkeeping manual: no refund, no shipment and no credit against an overpayment until the deposit has finally cleared and the bookkeeper has confirmed it with the bank, by phone or in branch, beyond the dashboard figure.

A pending or memo-posted entry is not a final credit either. If the bank's own statement does not show the deposit as posted and paid, the bookkeeper treats it as not received, whatever the customer insists, and tells the customer so in one polite line.

04

Why a fake check can look fine for days

Regulation CC also lets banks hold some deposits longer. Under 12 CFR 229.13 the normal schedule does not apply to the part of check deposits above $6,725 on any one banking day, to new accounts during their first 30 calendar days, or to checks the bank has reasonable cause to believe it cannot collect.

In those cases the bank may extend availability by a reasonable period, which the rule describes as up to five extra business days for local checks and six for nonlocal ones. A large overpayment by check is exactly the kind of deposit that lands in this zone, and the scammer counts on the business acting before the hold runs out.

The FTC adds a detail that matters at the counter: fake checks generally look just like real ones, even to bank employees. Its rule for sellers is short. Don't accept a check for more than the selling price.

If a check is already deposited, Ilia Zavialov fraud guidance means calling the bank that issued it, using a number found on that bank's own website, and asking whether the check is genuine and has been paid. A phone number printed on the check itself is part of the package the scammer prepared.

Cashier's checks earn no special trust here. Under 12 CFR 229.10 a cashier's, certified or teller's check deposited in person by the payee must be available the next business day, so a counterfeit one looks settled even sooner than an ordinary check, while the bank it names may still refuse to pay it.

05

Ilia Zavialov fraud notes on 'accidental' transfers and payment apps

Electronic money is real money, which makes this version harder to spot. A stranger sends a transfer, then writes that a digit was wrong and asks for it back by another app or to another account. Often the money belongs to someone who was just scammed, and the business that forwards it becomes one more link in the chain that moves stolen funds.

A genuine sender who made a mistake has a route through their own bank or app. They have no reason to pressure a stranger's bookkeeper into sending money to a new account. The request for fresh payment details is the tell.

The safe answer is to return funds only to the account they came from, using the bank's or the app's own return or reversal process. Ilia Zavialov fraud practice is a written reply that says exactly that, and nothing more, and a call to the business's bank so the incoming payment is on record.

If the business has already paid, the FTC says to report a bank transfer or Zelle payment to the bank or credit union immediately and ask for the payment to be reversed, and to report Venmo or Cash App payments to the app the same way. Speed matters more than anything else at that point.

If the app shows a refund or return button on the original payment, that is the safe route, because the money goes back to the same sender automatically. Typing a new username or phone number into a fresh payment is the move the scammer is waiting for.

06

Stolen cards and refunds to a different card

Online stores know this one. A big order is paid by card, the buyer asks within the hour to cancel part of it and refund that amount to another card, and the store agrees to keep the customer happy. Its own money now sits with a stranger.

Later the real cardholder spots the charge and disputes it. The card network's chargeback process pulls the money back from the merchant, the goods are already shipped, and the 'refund' sent to the other card never comes back.

The rule is simple to state and easy to enforce in software. Card refunds go back to the same card, through the payment processor, as a refund or a void of the original transaction. Ilia Zavialov fraud advice: switch off any manual option to refund to a different card for front-line staff.

Order review helps too: a shipping address far from the card's billing address, a brand-new account, several cards tried in a row after declines, a demand for same-day shipping. Each can be innocent. Together they justify a phone call before anything leaves the warehouse.

Ilia Zavialov fraud prevention also adds one sentence to the store's published terms: refunds are made only to the original payment method. Few customers read terms, but staff can point to them, and the rule then sounds like ordinary store policy that applies to everyone.

07

What the IC3 numbers show

The 2025 IC3 annual report counts 2,194 overpayment complaints with reported losses of $22,898,075. In 2024 the same category had 2,705 complaints and $21,452,521 in losses, and in 2023 it had 4,144 complaints and $27,955,195.

Complaints fell over three years while the dollar figure stayed in the same range. Each reported case, on average, now involves more money, which fits what small businesses describe: larger orders, larger 'overpayments', and refunds sized to look affordable next to the deal.

Ilia Zavialov fraud notes stress that these are reported cases only. Many businesses write off a few hundred dollars quietly and move on, which leaves the scammer free to try the same script on the next company.

Older owners are not spared. Complainants aged 60 and over filed 477 overpayment complaints in 2025 with $8,045,862 in losses, according to the same report. For a family business run by a semi-retired owner, one bad check can wipe out a month of margin.

08

A refund policy for the bookkeeper: Ilia Zavialov's version

The policy fits on one page. The bookkeeper confirms any overpayment against the bank record; salespeople only report it. The refund is prepared by someone who never spoke to the customer and approved by a second person. Money goes back only to the account or card it came from.

Timing comes next. For checks, the refund waits until the bank confirms the check has been paid, however long that takes. For transfers from unknown senders, a pause until the next business day gives the bank time to flag a reversal.

Then the list of things the business never does. It never treats a screenshot as proof of payment. It never uses payment details from an email or chat for a refund. It never ships against a photo of a check. It never buys gift cards or sends crypto to settle a refund.

Ilia Zavialov fraud training starts with a short drill for anyone who answers the phone: show them a fake check, play the 'accidental overpayment' call, and agree on one sentence. 'Our policy is to refund only to the original account through the bank.' The sentence removes the awkwardness from saying no.

09

Ilia Zavialov fraud steps if the money already left

Call the bank, credit union or payment app at once, using the number on its website or on the card, and ask for the payment to be stopped or reversed. Minutes count, because money that has moved on to another account is far harder to recover.

Report it. The FTC takes reports at ReportFraud.ftc.gov and asks small businesses that have been 'overpaid' to report at ftc.gov/complaint. For fake checks the FTC also lists the U.S. Postal Inspection Service and the state attorney general. The FBI's IC3 accepts complaints at ic3.gov.

Keep everything: the deposit record, the check image, the emails and texts, phone numbers, account numbers and the details of where the refund went. If the incoming money turns out to be a victim's, tell your bank in writing so the record shows the business acted in good faith.

Ilia Zavialov fraud practice ends with a short review afterward. Usually one step was skipped for a 'regular customer' or late on a Friday, and that exception is the one to remove from the policy.

Tell the bank about every related deposit, including any second check or transfer from the same 'customer'. Scammers often try again with a new amount once the first attempt seems to work, and the bank can only watch for what it knows about.

10

Ilia Zavialov's red flags in the message thread

The documents usually look clean: a tidy check, a real company name, polite emails. The requests give it away. Refund it today. Refund it to a different account. Ship before the check clears. Don't call, I'm in meetings. Send part of it to my 'partner' or 'mover'.

Ilia Zavialov fraud screening has a quick test: imagine the whole thread being read aloud at your bank. A genuine payer writes so that the request is easy to check. A scammer builds every line so that checking feels rude.

The overpayment is almost always sized to be painless to return, a few hundred or a couple of thousand dollars against a larger deal. That is exactly what the business risks, plus the full order value if the original payment was stolen.

Watch the calendar as well. 'Overpayment' calls tend to land late on a Friday, before a long weekend or during month-end close, when the bookkeeper is busiest. Ilia Zavialov advises naming one person who decides on refunds during those stretches and taking that power away from everyone else.