"Please refund the difference": three fake-payment tricks and the check that stops each one

You’re selling a used phone for 100 USDT. The buyer sends a screenshot: 1,000 USDT, sent to your address. A minute later: “So sorry, I typed an extra zero. Could you refund the 900 to this address? My family needs it tonight.” You open your own account and there is nothing there. Or there are 100 USDT, or 1,000 of something that only calls itself USDT.

The refund is the scam. You would be sending 900 real USDT to cover 1,000 that never arrived. The rule that stops this and the two tricks below is short: nothing leaves your hands, not the goods, not a refund, not “the difference”, until the full amount is in your own account’s history. Crypto payments are typically not reversible, so once you send that refund it is gone unless the other person chooses to send it back.

All three tricks follow the same pattern. They build a believable picture, then ask you to act before you have checked. For the full step-by-step check, see how to confirm a crypto payment has arrived.

Trick 1: an edited screenshot or a fake “payment sent” email

This is the oldest trick, and it works because the image looks exactly like a real app. The payer takes a genuine “withdrawal submitted” screen and changes the amount and address, or builds one from scratch. The email version arrives in your inbox styled like your exchange, with the logo, the amount and a friendly “You have received 1,000 USDT”. Some include a button to “confirm receipt” or “release funds”, which leads to a page that asks you to log in.

The moment it asks you to act. Straight after the picture arrives: “I’ve paid, please ship today”, “send me the files”, “send the gift card code”. There is usually a reason it can’t wait: a flight, a sick relative, a boss who is watching.

The check that stops it. Close the chat and the email. Open your exchange or wallet app the way you normally do, from your own home screen or bookmark, and look at the deposit history. If the amount isn’t there, you haven’t been paid. Never log in through a link in a “you’ve been paid” email: the page may copy your password and code, and then the loss is your whole balance, not one sale.

A reply that keeps things calm:

Thanks for the screenshot. I only confirm payments from my own account history, and it isn't showing yet. Could you send the transaction ID (TXID) as text and the network you used? I'll ship as soon as it shows on my side.

A real payer can copy a TXID from their history in under a minute. Someone with only an edited picture will usually start pushing harder, or disappear. Better still, say it before anyone pays, in the same message as your address and network; what to send your payer covers that message.

Trick 2: the overpayment and “please refund the difference”

This one is older than crypto. The US Federal Trade Commission describes the pattern: a fake job or sale where you are “paid” too much, often by a cheque that later turns out to be counterfeit, and asked to send the extra on, sometimes in crypto. When the cheque bounces, in the FTC’s words, “the money will be gone, and you’ll be on the hook to repay that money to your bank.”

The crypto version comes in three shapes:

• The overpayment exists only in a screenshot, as in the phone sale above.
• A small real payment arrives, and the scammer claims a larger one was sent, hoping you won’t read the history carefully.
• The “overpayment” came by a method that can be reversed later, such as a bank transfer, card payment or cheque, and they want the difference back in USDT, which can’t.

The moment it asks you to act. The refund request. It nearly always comes with urgency, an apology and, tellingly, a different address: “please send it to my brother’s wallet”, “my account is locked, use this one”.

The check that stops it. Ask yourself one question: is the extra amount in my available balance right now, as the real token, and from a payment method that can’t be pulled back? If not, there is nothing to refund. Even when it is, a stranger’s overpayment is a reason to slow down, not speed up. I’d offer to cancel the whole deal and return the full payment to the same account it came from, once it has cleared. A genuine buyer who made a typo can live with that. A scammer can’t, because there was never any money to return.

Trick 3: a lookalike token, and “it’s pending, release first”

Anyone can create a token on a blockchain, name it “USDT” and give it the familiar green logo. A scammer sends you a pile of that copy. In a self-custody wallet it can show up with a balance, and on an explorer the transfer looks real at a glance: a success status, your address, “1,000 USDT”. It just isn’t Tether’s USDT, and it isn’t worth anything.

The pressure version needs no token at all. The payer says the transfer is “pending”, “processing”, or “stuck on the network”, and asks you to release the goods or the crypto now because “it will land any minute”. On a P2P sale it sounds like: “I’ve paid by bank transfer, the bank says pending, please release.”

The moment it asks you to act. “Release first.” “Confirm the order so the payment can complete.” Nothing on a blockchain waits for you to release something before it arrives. A payment that needs your action to finish isn’t a payment.

The check that stops it. Two parts, depending on the version:

1. For a token, open the transaction on the explorer for that network, click the token name and read the token’s own page. The real USDT is issued by Tether, with a long history and a very large number of holders. A copy is usually new, with few holders and no issuer details. The simpler backstop: an exchange only credits the tokens it lists, so a fake never appears in your exchange’s USDT balance.
2. For “pending”, pending means not arrived. On a P2P sale, you release only after the full amount is in your own bank account, in the buyer’s name, which you check in your banking app yourself. The steps for that are in selling USDT on P2P for the first time.

If you’ve already sent the refund or released the crypto, stop there. Don’t send anything more, including “fees” to release a refund or “taxes” to reverse the transfer. Then:

• Collect everything: the chat, the payer’s username and profile link, every address and TXID, the screenshots they sent you, and the time of each message.
• Report it to the platform where you met them, whether that’s the marketplace, the exchange or the P2P order’s appeal button, and include the TXIDs.
• Report it to your local police and your country’s consumer protection or fraud agency.

Expect the next message to come from someone else. People who have just lost money are targeted by “recovery” services and “blockchain investigators” who promise to trace and return it for an upfront fee. That is a second scam on the same victim. The FTC’s point applies here too: you can usually only get crypto back if the person you paid sends it back, and nobody can make that happen for a fee.