Fraud

Overpayment scams are fairly common, and for the unaware, they can be difficult to spot. Let’s take a look at these scams and what you need to know to avoid falling victim to these ruses.

What is an overpayment scam?

In an overpayment scam, fraudsters target an individual who’s selling a large item online, such as a car. The scammer will reach out to the seller, offering to buy their car for more than the asking price. Then, they’ll send the seller payment in the mail.

At this point, the seller is thrilled. But, when the check comes, it brings with it a surprise – they’ve been overpaid. Soon after, the alleged buyer contacts the seller to ask them to refund the surplus. The seller may think it’s strange, but they comply, not wanting to keep money that isn’t theirs. The next thing they know, the original check hasn’t cleared and they realize they’ve been scammed. Not only have they not been paid for the purchase they believed the check writer was buying, but they’ve also lost the money they’ve sent back to the scammer.

Red flags

When selling an item on an online platform, look out for these red flags, which can alert you to a possible overpayment scam:

• You’re offered more than your asking price for an item you’re selling online.
• You get paid more than you’re owed for an item you’re selling.
• You’re urged to act quickly and take up a buyer on an offer or risk having them pull the offer off the table.
• You’re asked to refund an overpayment via wire transfer or prepaid debit card.

If you encounter any of these red flags while trying to sell an item online, do not engage with the “buyer.” Block their email address and mark it as spam to avoid further contact from the scammer. You may also want to report them to the platform you’re selling the item on to help stop them from reaching out to others.

How to avoid overpayment scams

The FTC offers the following tips for avoiding overpayment scams when selling online:

• Always know who your buyer is. Confirm the buyer’s name, street address and telephone number independently.
• Never accept payment for more than your selling price.
• Never agree to finalize a transaction until the buyer’s check has completely cleared. This can take several days.
• Never agree to wire funds back to a buyer.
• Don’t be tempted by offers that urge you to “act now.” If a buyer is offering you a price that seems too good to be true, it may just be a scam. Slow down, and research the buyer thoroughly before reaching any agreements.
• It’s best not to accept payment by a check from an unknown buyer.
• If you do accept payment by check, ask for a check that’s associated with a local bank, or a bank with a local branch. This way, you can visit the bank to determine if the check is authentic. If you cannot get a check from a local bank, ask for the bank’s phone number and call it to verify its validity.
• If cash is not an option and you want to avoid checks, consider an alternative method of payment, such as an escrow service or online payment service. If the buyer wants to use a service with which you are not familiar, verify its legitimacy before agreeing to accept payment from this service. You can research its website, customer service hotline, read its customer reviews and more.

If you’ve been targeted

If you believe you’ve been targeted by an overpayment scam, there are steps you can take to mitigate the damage.

First, report the scam to your financial institution, as they may be able to reverse the payment. Next, alert the FTC at ftc.gov so they can do their part in catching the criminals. Finally, you can let your local law enforcement agencies know about the scam and warn your friends and family about it as well.

Don’t get caught in an overpayment scam! Use this guide to stay safe.

Here’s what you need to know about one-time password scams and how to avoid them.

What is a one-time password scam?

One-time password (OTP) scams are designed to trick individuals into sharing their OTPs, which scammers then use to gain unauthorized access to accounts. Here are the various ways these scams go down:

• Phishing scams. Here, cybercriminals send fake emails or text messages that appear to be from legitimate sources, such as credit unions or banks, online retailers, or social media platforms. These messages often contain urgent requests to verify your account or resolve an issue, prompting you to enter your OTP on a fraudulent website.
• Vishing (voice phishing). In this scam, scammers call victims pretending to be from a reputable organization, such as a bank or government agency. They may claim suspicious activity on your account and request your OTP to secure your account, exploiting your trust and urgency.
• Man-in-the-middle attacks. In this method, attackers intercept communications between you and a legitimate service provider. When you request the OTP, an attacker captures it and uses it to gain access to your account.
• Social engineering. Scammers use psychological manipulation to trick you into revealing your OTP. They may impersonate friends, family, or colleagues, convincing you that sharing the OTP is necessary for a legitimate purpose.

Whichever method is deployed in an attempt to steal your OTP, the scammer will then use it to access your accounts and possibly steal your identity

Red flags

Avoid falling victim to a one-time password scam by watching out for these red flags:

1. Unexpected requests. Be cautious of unsolicited messages or calls asking for your OTP. Legitimate organizations typically won’t ask for your OTP unless you’re actively engaged in a transaction or login process.
2. Urgency and threats. Scammers often create a sense of urgency, claiming that immediate action is required to prevent account suspension or fraud. For example, a text message allegedly sent from your financial institution may claim you have 10 seconds to input the one-time password to verify your account. This tactic can make you act without thinking.
3. Unusual sender information. Check the sender’s email address or phone number carefully. Often, scammers use addresses or numbers that are slightly altered versions of legitimate ones.
4. Suspicious links. Hover over links in emails or messages to see the actual URL before clicking. Be wary of links that don’t match the official website of the organization they’re purportedly from.
5. Generic greetings and language. Scammers often use generic greetings like “Dear Customer” to send out mass emails. Their missives also tend to have spelling or grammatical errors. Legitimate communications are usually more personalized, professional, and proofread.

Protect yourself

Staying safe from OTP scams requires vigilance and adopting best practices for online security. Here are some steps you can take:

• Never share your OTP. Treat your OTP like your password — never share it with anyone, even if they claim to be from a trusted organization.
• Verify the source. If you receive a request for your OTP, verify the legitimacy of the request by contacting the organization directly using a known and trusted communication method.
• Use multi-factor authentication (MFA). Whenever possible, enable MFA on your accounts. MFA typically involves a combination of something you know (password) and something you have (OTP), providing an additional layer of security.
• Be wary of links. Avoid clicking on links in unsolicited emails or text messages. Instead, navigate to the organization’s official website directly through your browser.
• Install security software. Use antivirus and anti-malware software on your devices to help detect and prevent phishing and other cyber threats.
• Educate yourself and others. Stay informed about the latest scam tactics and share this knowledge with friends and family, especially those who may be less tech-savvy.

If you’ve been targeted

If you believe you’ve been scammed and/or have shared your OTP, take immediate action.

First, change the passwords on all affected accounts and those that have similar login credentials. Next, inform the host organization of the account that it’s been compromised. They can help secure your account and guide you on additional steps to take. Monitor your accounts in the ensuing weeks and months, keeping a close eye on your financial statements and account activity for any unauthorized transactions. Finally, file a report with your local consumer protection agency, the Federal Trade Commission (FTC), and the Internet Crime Complaint Center (IC3).

You may also want to consider identity theft protection at this time if sensitive information was compromised.

One-time password scams can be difficult to spot and wreak massive damage. Use this guide to learn about one-time password scams and how to prevent yourself from falling victim.

Stay safe!