"I sent you money by mistake, please send it back": the mistaken payment scam

"I sent you money by mistake, please send it back": the mistaken payment scam

"Hi, so sorry, I sent you $250 by mistake through PayID, I mixed up a number in my mobile. Could you please send it back? I need it for rent today." The message is polite, a little desperate, and seems like the honest thing to sort out. But it's a classic con. In Australia, fast payments through PayID and Osko land in seconds and are hard to reverse, which is exactly why scammers use them. Whatever the story, the rule is the same: don't send anything back yourself, check your account in your banking app, and let your bank handle any genuine mistake.

How does the mistaken payment scam work?

There are three variants, and the opening message is almost identical in all of them:

• The money doesn't exist: it's a fake notice. They send a screenshot of a supposed receipt, or an email or text imitating your bank or "PayID" ("You have received $250.00, pending release"). Nothing appears in your actual account, but the message is convincing enough for you to "return" the money yourself. Remember: PayID payments arrive straight into your bank account, and you don't get emails from "PayID" asking you to do anything.
• The money doesn't exist: it's an approval in disguise. Instead of paying you, they set up something that takes money from you: a payment request in a payments app, or a PayTo agreement waiting for your approval in your banking app. They tell you to "accept" or "confirm" to receive the refund. If you approve it, the money leaves your account.
• The money is real, and that's the problem. In the most elaborate version, the deposit is genuine: it comes from a hacked account or a stolen card. They ask you to send it back, but to a different account or PayID ("that was my mum's", "my account's frozen"). If you do, the original deposit can later be recovered from your account once the real owner reports the fraud, so you can end up losing what you sent. And you've moved stolen money, which can turn you into a money mule without realising.

In every case the pattern repeats: friendliness, a touch of urgency and a request that you act yourself, quickly, outside your bank's own processes.

How can I tell it's a scam?

• The money isn't in your account when you check your banking app yourself (not a screenshot, not an email).
• They want it sent somewhere else: a different name, a different account, a different PayID.
• They push you to "accept", "approve" or "confirm" something in your banking app. Receiving a payment never needs your approval.
• Urgency and emotion: rent due today, a sick child, a blocked account.
• They ask for codes, or a "bank officer" calls to help you return it.
• They get pushy or aggressive when you say you'll go through your bank.

What should I do right now?

1. Open your banking app yourself (not a link) and check whether the money actually arrived.
2. Don't send anything back yourself, even if the money is there. Don't approve any payment request or PayTo agreement you didn't set up.
3. Call your bank on the number on your card or in its app and tell them about the "mistaken payment". Banks have a process for mistaken internet payments: if a deposit really was a mistake, the sender's bank contacts yours and the money goes back through official channels, to the right person. Major banks such as CommBank and Westpac publish guidance on scams and how to reach them.
4. Reply only once, if at all: "Please ask your bank to request a mistaken payment recall." A genuine person will do that. A scammer will push back.
5. Block the number and report it in the spam numbers directory.

What if I've already sent the money or approved a request?

1. Call your bank immediately and explain exactly what happened, including the account or PayID you sent money to. Ask them to try to recall the payment and to cancel any PayTo agreement you approved.
2. Don't send any more, whatever new story they come up with.
3. If you passed on money that was deposited into your account, tell your bank and police straight away. Being upfront is your best protection if the funds turn out to be stolen.
4. If you shared codes or banking passwords, change them from a trusted device and tell your bank.
5. Keep everything: messages, screenshots, the sender's details and your transaction receipts.

Where do I report it and who can help?

• Your bank, first and fastest.
• Police, through ReportCyber via the AFP's cybercrime page, especially if money was lost or your account was used to move funds.
• Scamwatch, so the National Anti-Scam Centre can track the campaign.
• IDCARE (1800 595 160), if you gave out personal or identity details.
• The Australian Financial Complaints Authority (AFCA), if you're unhappy with how your bank handled it after complaining to the bank first.

Frequently asked questions

Can someone take money just because they know my PayID? No. Your PayID (usually your mobile number or email) only lets people pay you. Money can only leave your account if you send it or approve something, such as a PayTo agreement.

Someone really did deposit money into my account. Isn't it more honest to send it back myself? The honest move is to tell your bank. If you send it back yourself and it was stolen, you lose the money twice, and you may have helped launder it. Your bank will return a genuine mistake to the right person.

Someone claiming to be from my bank is calling to "help me return" the payment. Can I trust them? No. Hang up and call your bank yourself on the number on your card. Banks won't call to ask you to move money or read out codes.

What if the message comes from a friend's number? Their account or phone may have been compromised. Call them on their usual number before doing anything.

In short

"I paid you by mistake" is either a fake notice, an approval in disguise or stolen money looking for a mule. Check your account yourself, never send money back on your own, never approve anything you didn't set up, and let your bank handle any real error. If you've already paid, call your bank and report it through ReportCyber and Scamwatch. And report the number in the NoCall spam numbers directory.