Click here to get this post in PDF
I won my first proposal from a cold, organic lead not long ago. Everything before it had come through connections and referrals. A catering startup wanted a ten-plus-page website, signed my agreement, and told me a cashier’s check was already in the mail. I was thrilled for about a day.
Then the client asked me to do something odd. Could I pay their project consultant $2,850 directly out of the first milestone payment? Just to streamline the accounting, they said. It would all come out in the wash once the check cleared.
I spent a few minutes trying to justify it, because I didn’t want to admit I was being scammed. There was no version of it that held up.
That request is the whole scam in one sentence. It’s the classic overpayment con: a bad or bounced check arrives, and before it clears, you wire real money to a “third party” who is actually the scammer. The bank later claws back the worthless check, and you’re out whatever you sent. I didn’t lose a cent, because by then the red flags had stacked too high to ignore. But I had to go looking to see them, and that’s the part worth passing on.
The red flags I almost talked myself out of
Every one of these came with a reasonable-sounding excuse attached. That’s how they work.
The client wouldn’t get on a video call, citing a recent nose procedure. They withheld the LLC name until after I’d finished the proposal. When I finally ran that name through the Secretary of State’s business search, the registered entity was an Indian grocery store, not a catering company. The email on record didn’t match the address I’d been corresponding with. And the request to pay their “consultant” came from an unrelated consultancy with no connection to the project.
No single one is proof. Together they’re a signed confession. The lesson isn’t “spot the one tell.” It’s that legitimate clients don’t rack up five weird exceptions, and no real business streamlines its accounting by having a brand-new vendor pay its other vendors. I wrote up the full sequence in this breakdown of the RFP scam if you want the play-by-play.
What’s new in 2026: the same con with better tools
The overpayment scam is old. What’s changed is the production quality. Scammers have cheap AI now, and they’re using it to make old cons harder to catch.
Fake RFPs at scale. AI writes a polished, specific-sounding project brief in seconds, so the bait no longer reads like a scam. A convincing proposal request costs the sender nothing and lands in your inbox looking like the best lead of your month.
AI voice calls. I never got one of these, but they’re common now. Voice cloning is cheap and good enough that a phone call is no longer proof of who’s on the line. Someone who sounds like a supplier, a client, or your own bookkeeper can ask you to change payment details or approve an urgent transfer. The urgency is the tell. The voice isn’t the verification it used to be.
Payment redirection. The most expensive version skips the theatrics: an email or call, seemingly from a known vendor, asking you to update the bank account on file for their next invoice. You pay the “vendor” as usual. The money goes to the scammer.
The three habits that stop almost all of it
You don’t need to memorize every scam. You need a few reflexes.
Verify money changes on a second channel. If anyone asks you to send funds, pay a new third party, or change bank details, confirm it by calling a number you already had, not the one in the message. This one habit defeats the overpayment scam, the vendor redirect, and the cloned voice call at once.
Do the two-minute background check. Run the business name through your state or national company register, confirm the entity matches the story, and check that the contact details line up. Two minutes would have flagged my grocery-store “caterer” instantly.
Treat urgency as a warning, not a reason to rush. “The check’s in the mail, just pay the consultant today” is engineered pressure. Real business runs on a schedule. A deal that falls apart because you took a day to verify was never a deal.
Winning the work feels great. Keeping the money is the actual job. When something about a payment feels slightly off, that feeling is data. Slow down and check.
More practical, hype-free guidance for small businesses at the Marshland Software blog.
You may also like: Online Fraud Surges as Digital Identities Become More Sophisticated
Image source: elements.envato.com
