- In a legitimate payment, money moves toward you. The instant a deal needs you to send money out, refund an "overpayment", or pay to "release" your own funds, you're being scammed.
- Nobody should ever need access to your account. No real payout requires it.
- Slow down. These scams run on urgency, and a five-minute pause kills almost all of them.
Most advice about online payments is written for buyers. If you're a freelancer or seller, your risk is different and quite a bit higher. You're the one expecting money, and you're motivated to close the deal, which is exactly what makes you a target. None of the scams below are exotic. They're the same small set, repeated endlessly, because they keep working. Learn their shapes once and they become almost impossible to fall for.
The master key
Almost every scam here breaks one principle: you should never have to send money, or hand over access, to receive money you're owed. Hold that line and you're most of the way safe.
1. The overpayment / refund trick
A buyer or "client" sends you more than agreed. Sometimes it's framed as a "mistake", sometimes as a deposit for materials. Either way, they ask you to refund the difference, or to forward part of it to a "shipper" or "assistant". You send the refund. Days later, the original payment is reversed, declined, or turns out to have been funded with a stolen card. The money you sent back was real. The money you "received" was not.
Red flags
- The payment arrives larger than what you agreed on.
- You're pushed to refund or forward part of it in a hurry.
- The explanation drags in a third party you've never dealt with, like a "shipper" or "agent".
What to do
Never refund from your own funds against an incoming payment. If a payment really is too large, cancel it and ask the sender to redo it correctly. Let the money settle and clear in full before you act on it at all.
2. The fake "payment on hold" email
You get a message that looks like it's from PayPal (or Payoneer, or your bank). Your payment is "held", it says, and will be released once you ship the item / upload tracking / upgrade your account / pay a small fee. The whole thing is built to make you act before you think, either by sending goods you won't be paid for, or by clicking a link to a fake login page.
Red flags
- Your money is "held" pending some action you must take outside the app.
- There's a link to "verify" or "release" funds, and it lands on a login page.
- The sender address is almost, but not quite, the real domain.
What to do
Real holds are shown and resolved inside your account, never through an email link. Don't click anything. Open a fresh browser tab, type the provider's address yourself, and check your actual account. If there's a genuine hold, it'll be there. If there isn't, you've just dodged a phishing page.
3. The cash-out middleman
This one is everywhere in regions where PayPal withdrawal is restricted. Someone offers to "receive and withdraw your PayPal for you", or to "sell you a verified account", for a fee or a cut. The moment you route money through them or share access, you've handed a stranger control of your funds and often your identity too. The money vanishes. Sometimes the account is then used to commit fraud in your name.
There is no safe version of this
If withdrawal isn't enabled for your account, the fix is to receive future payments somewhere that pays out to you directly. Don't let a third party "handle" your balance. See our country guides for the legitimate routes.
4. Phishing and fake support
Beyond the hold email, watch for fake "support" accounts on social media that swoop in the moment you post a complaint, and for messages nudging you to "confirm your details" or move the chat to WhatsApp or Telegram. What they're after is always the same: your login, your one-time code, or remote access to your device.
What to do
- Never share a one-time passcode. No legitimate company asks for it, and real staff never need it.
- Reach support only through the official app or website. Never use a number or handle that someone DMs you.
- Turn on two-factor authentication with an authenticator app, and keep a unique password for each service.
5. The crypto P2P release trap
If you ever convert crypto to local cash through a peer-to-peer market, this is the scam to know. Say you're selling USDT for naira or rupiah. The buyer uploads a screenshot of a "completed" bank transfer and starts pressuring you: "I've paid, please release, I'm in a hurry." Release the coins on the strength of that screenshot and you find out the transfer was faked, reversed, or sent from a third party's account that later disputes it.
What to do
- Release coins only after the money has actually landed in your own banking app. A screenshot doesn't count, and neither does the platform showing "paid".
- Be wary of payments from a name that doesn't match the buyer's verified identity.
- Use the exchange's escrow and dispute tools, and never move the deal "off-platform".
6. The fake job / advance-fee variant
A too-good "client" hires you fast, then needs you to buy software, pay a "registration", or pick up gift cards "to be reimbursed". Or they send a cheque or transfer to "set up your equipment" and ask you to forward part of it. It's the overpayment scam wearing a job offer.
What to do
You should never pay to get a job, and you should never forward money out of a client's payment. Real clients pay you. They don't ask you to spend first and trust them to pay you back.
A 30-second safety checklist
Before you act on any payment or "opportunity", run through these:
- Is anyone asking me to send money out, refund, or pay a fee to receive my own money? → Stop.
- Is anyone asking for my password, one-time code, or account access? → Stop.
- Am I being rushed? → Slow down on purpose; urgency is the tool.
- Did I verify this inside the official app, not via a link or DM? → If not, do that now.
- Has the money actually cleared in my own account/bank? → If not, don't act on it.
If you've already been hit
Act fast: change your password and enable two-factor immediately, report the transaction inside the provider's app, contact your bank if a card or account was involved, and cut off all contact with the scammer. And don't pay a "recovery agent" who promises to get your money back. That's a second scam, aimed squarely at victims of the first.
FAQ
Is a PayPal payment safe once I see it in my account?
Not always. A payment can still be reversed if it's disputed or was funded fraudulently. Your safest move is to let funds clear in full, ship only after that, and never refund against a payment that hasn't settled.
How do I tell a real PayPal email from a fake one?
Don't try to judge the email at all. Ignore its links, open the official site or app yourself, and see whether the claim holds up there. If your money were genuinely held, it would show up in your account.
Someone reputable-looking offered to withdraw my balance. Still a scam?
Yes. Looking professional is part of the act. No legitimate arrangement asks you to hand your balance or your access to another person. Use a service that pays out to you directly instead.
We update this guide as new scam patterns appear. Seen one we've missed? Tell us so we can warn others.