Ilia Zavialov fraud explainer: a customer overpays and asks for the surplus back. When the money is really yours and where refunds go

01

Ilia Zavialov fraud explainer: the overpay-and-refund trick in UK firms

Ilia Zavialov, who advises small teams on digital security, keeps this trick apart from invoice fraud and mandate fraud. Nobody needs to hack an email account here. The fraudster leans on courtesy, on embarrassment and on the gap between a notification on a phone and the moment money is truly settled.

It always runs in the same order. Money arrives, or appears to. A polite but urgent request follows to send part of it back by another route. Then the original payment fails, is recalled or turns out to belong to a victim. The refund came from the firm's own account and cannot be pulled back.

Sole traders and small limited companies are the usual targets: online sellers, tradespeople taking deposits, tutors, letting agents, wedding and events suppliers. Wherever one person both talks to customers and moves money, the trick has room to work.

Timing helps the fraudster. A banking app pings within moments of an incoming payment, yet many small firms reconcile the account only once a week. The call lands in that gap, while the owner sees a notification and nothing else, with a request to 'just sort it now'.

Ilia Zavialov fraud advice frames it as a question of route: who is asking, and where do they want the money to go? If the route back differs from the route in, the request stops there until the bank confirms it.

02

How the trick reaches a UK finance inbox

The cheque variant is the classic. A buyer posts a cheque for more than the invoice and asks for the surplus by bank transfer before it clears. The bank-transfer variant uses real money: a Faster Payment lands, then a message asks for the 'extra' to go to a different account.

The recall variant hits after the refund. The incoming payment is disputed or reported as fraud by the person who actually sent it, and the firm loses both sums. The card variant starts with a large online order, then a partial cancellation and a request to refund to a different card.

What links all four is the route of the refund. The fraudster always wants it to go somewhere new, quickly, outside the bank's own return process. That single detail separates a genuine customer from the trick more reliably than any document.

Sole traders who take card payments on a phone or a small terminal are especially exposed, because the same person takes the order, issues refunds and answers the phone. Nobody else sees the request before the money moves, and nobody is there to say 'hang on'.

03

Ilia Zavialov fraud rule: cleared funds on the statement

For a finance team the working rule is short: money has arrived when it shows on the bank statement as cleared, and only then. A screenshot of a banking app, a PDF 'remittance advice' or an email that claims to come from the payer's bank proves nothing at all.

Ilia Zavialov fraud guidance is to write that rule into the finance procedure word for word. Goods ship, services start and refunds are considered only against cleared funds. Staff then have something to point to when a customer pushes, and nobody has to argue on their own authority.

The check takes two minutes. Log into online banking directly, never through a link in the message, and find the payment by amount, date and payer name. If it is not there, there is nothing to refund.

The short video below runs through these variants in about half a minute: a cheque that never clears, a stranger's 'accidental' transfer, a refund to someone else's card and the rule that blocks each one. UK Finance recorded 3,196,962 card-not-present fraud cases in 2025, so a card refund should only ever go back to the card that paid.

An available figure in a banking app can include payments the bank is still checking. If the statement line is missing or marked as pending, the finance team treats the money as not received and tells the customer so, politely and in writing.

04

Cheques: rarer now, still in play

UK Finance's Annual Fraud Report 2026 puts cheque fraud losses for 2025 at £4.1m across 795 cases, the lowest loss total and the lowest case total it has ever reported. The report splits cheque fraud into counterfeit, forged and fraudulently altered cheques.

Low numbers do not make a cheque safe for a small firm. The overpayment trick needs only one cheque that looks right for a few days. A counterfeit drawn on a genuine account, or a genuine cheque with the amount altered, both fit the script.

Ilia Zavialov fraud advice is to treat any cheque for more than the invoice as a refusal case. Return the cheque itself, ask for payment of the correct amount by bank transfer, and send nothing back while the cheque sits in the system.

If a cheque has already been paid in, ring the bank that issued it, using a number from that bank's own website, and ask whether it is genuine. A phone number printed on the cheque or in the covering letter belongs to the script and will be answered by the same people.

Cheque-based variants often arrive with a covering letter explaining the surplus: a shipping fee, an agent's commission, an error by 'our accounts team'. The story changes from case to case. The request to pass on the difference stays the same.

05

Ilia Zavialov fraud notes on card-not-present orders

UK Finance defines remote purchase fraud, also called card-not-present or CNP fraud, as a criminal using stolen card details to buy something online, over the phone or by mail order. In 2025 it came to £423.5m and 3,196,962 cases, with case numbers up 13 per cent.

The cardholder is well protected. Under regulation 77 of the Payment Services Regulations 2017, a bank can hold a payer liable for at most £35 of losses from a lost or stolen payment instrument, unless the payer acted fraudulently or with intent or gross negligence. The loss travels back towards the merchant.

That is why the partial-refund request matters so much. If the shop sends part of a stolen-card payment to a different card, the original charge can still be disputed, and the money sent to the second card is gone for good.

Ilia Zavialov fraud prevention needs one setting in the card terminal or payment gateway: refunds only to the card used for the original payment, with no manual option to choose another card for front-line staff.

Order checks still earn their keep: a delivery address far from the billing address, a brand-new customer account, several cards tried after declines, a demand for same-day dispatch. Any one of these can be innocent, so the response is a phone call to the customer before the parcel leaves.

06

Ilia Zavialov fraud notes on misdirected payments and the bank's duty

Genuine mistakes happen, and the law gives the sender a route that does not involve pleading with a stranger. Under regulation 90 of the Payment Services Regulations 2017, when a payer gives the wrong account details, the payer's bank must make reasonable efforts to recover the money.

The payee's bank must co-operate and pass on the information needed. If recovery fails, the payer's bank must, on written request, give the payer all available information so that they can claim the money back themselves.

For the firm that received the money, this sets the correct answer to any 'please send it back' message: the funds will be returned when the sender's bank asks, to the account they came from. A genuine sender accepts that at once. A fraudster suddenly loses interest.

Ilia Zavialov fraud advice on replies is to write back once, in plain terms, and copy the bank: 'We have received a payment we were not expecting. We will return it when your bank contacts ours, to the account it came from.' After that, further messages from the same sender need no reply.

The same logic covers an unexpected payment from a business customer. A genuine accounts department will happily raise the recall through its own bank. Only a fraudster insists on a quick manual transfer to fresh details.

07

APP reimbursement: does it cover your business?

If a firm was tricked into sending a refund by bank transfer, the Payment Systems Regulator's rules may help. Since 7 October 2024, reimbursement for authorised push payment fraud has covered individuals, micro-enterprises and charities, for transfers between UK accounts over Faster Payments and CHAPS.

The PSR asks victims to report as soon as possible and within 13 months of the payment. Reimbursement is expected within 5 business days, with a decision no later than 35 business days. The maximum claim is £85,000, and the Financial Ombudsman Service can look at complaints up to its £430,000 limit.

Card, cash and cheque payments have their own protections, which the PSR page says separately. Larger companies fall outside the micro-enterprise definition, so for them prevention is the only reliable defence.

It is worth knowing which side of that line your firm sits on before anything goes wrong. A finance lead who already knows can tell the bank on the first call which protections apply, and the claim starts days earlier.

Reimbursement also depends on the victim's part. The PSR expects prompt answers to the bank's requests for information, after checking that each request is genuine, and a report to the police or consent for the bank to report on the firm's behalf.

08

A refund procedure for UK finance teams: Ilia Zavialov's version

One page is enough. Whoever reconciles the bank account records the overpayment; sales staff only flag it. A refund is prepared by someone who has not spoken to the customer and authorised by a second person. Money goes back only to the account or card it came from.

For a sole trader without staff, the second person is the bank: a call to the number on its website before any refund over a set amount. For a limited company, two named people sign off, and neither is the salesperson handling the account.

The never-list goes at the bottom. No refunds against screenshots. No refunds to details supplied by email, text or chat. No goods released against a cheque that has not cleared. No one-time passcodes read out to a caller, and no remote access software installed at a customer's request.

Ilia Zavialov fraud training for small teams is a ten-minute rehearsal at a team meeting: show a fake remittance, play the 'accidental overpayment' call and agree the stock reply. 'Our policy is to refund only to the original account through the bank.'

Each case goes into one folder: the statement extract, the written request, the call note and the refund confirmation. Ilia Zavialov fraud files exist for one reason: if the bank or the police later ask whether the firm acted in good faith, the answer is already assembled.

09

Reporting it: your bank, Report Fraud and the police

Ring the bank first, using the number on its website or on the card, and ask it to try to stop or recall the payment. Then report to Report Fraud, the national reporting centre for fraud and cyber crime, on 0300 123 2040 or through its online form.

Report Fraud describes fraud as a criminal offence under the Fraud Act 2006 and asks businesses and other organisations under a live cyber attack to call 0300 123 2040 immediately. Keep the bank statement, the cheque or its image, emails, texts, phone numbers and the details of where the refund went.

If the money that arrived turns out to belong to a victim, write to your bank straight away and offer to return it through its own process. UK Finance reports that criminals stole £1.28bn from UK bank accounts in 2025, and a clean paper trail shows your firm was a target of that activity.

Ilia Zavialov fraud practice calls for a short review after any incident, whatever the amount. The weak point is nearly always an exception: a 'trusted' customer, a Friday afternoon, a manager who was out.

Staff who dealt with the fraudster should be warned too, because the same person may try again under another company name. Phone numbers and account details from the case belong on an internal block list for the sales team.

10

Ilia Zavialov's red flags in emails and calls

The paperwork usually looks neat: a tidy cheque, a real company name, courteous emails. The requests give the game away. Refund it today. Refund it to a different account. Release the goods before the cheque clears. Do not ring, I am in meetings. Send part of it to my shipping agent.

Ilia Zavialov fraud screening includes a test any finance assistant can use: picture the whole email chain being read by the bank's fraud team. A genuine customer writes so the request is easy to verify. A fraudster phrases every line so that verifying feels rude.

The surplus is nearly always pitched to feel painless, a few hundred pounds against a bigger order. That sum is exactly what the firm stands to lose, plus the full order value if the original payment was stolen.

Timing gives it away as well. Calls about an 'overpayment' cluster on Friday afternoons, before bank holidays and at month end, when finance teams are busy closing the books. Ilia Zavialov suggests naming one person to handle refund questions on those days, so nobody is tempted to act alone.