A message offers remote work, mystery shopping, or “reshipping.” A check or money order arrives for more than you are owed. The “employer” tells you to deposit it, keep your cut, and wire, Zelle, gift-card, or crypto the rest for supplies or a vendor. The check later bounces. The bank reverses the deposit. The money you sent is gone, and you may owe the bank.
This pattern sits next to other payment and identity pitches in Credit and debt scams and Phishing and account takeover.
Hard rules
- Real employers do not need you to cash a personal check and forward funds to “suppliers” before training.
- A check that “clears” in one to two days is often still provisional, banks can reverse fake checks days or weeks later.
- Payment demands in gift cards, cryptocurrency, wire, or P2P to a person you have not met in a verified workplace are fraud tells (Gift cards and prepaid debit risks; Zelle and P2P scams).
- Government agencies do not hire you by text and then demand payment to “release” a paycheck (Fake IRS and benefits scams).
Common scripts
| Pitch | What happens next | Tell |
|---|---|---|
| “You’re hired, equipment stipend enclosed” | Oversize check; buy laptop from their “vendor” | Vendor is the scammer; check is fake |
| Mystery shopper / payment tester | Cash checks or buy gift cards and report back | Legitimate mystery shopping does not start with forwarding funds |
| Overpayment “by mistake” | Deposit excess; refund the difference by wire | Fake check + irreversible send |
| Work-from-home reshipping | Receive packages; forward them | Often stolen goods; you become the mule |
| “HR” on WhatsApp / Telegram only | Never a real career site or email domain | No verifiable company footprint |
Advance-fee cousins (“pay $199 for placement”) overlap Advance-fee loan scams, same “pay first, job later” structure.
Worked example: the $3,850 “equipment” check
Sam answers a LinkedIn DM for a remote admin role. “HR” emails a $3,850 cashier’s-check image and says Sam’s salary starts next week; $2,400 must go to an Apple Store gift-card bundle for a MacBook “from our vendor list,” with $1,450 kept as the first stipend.
Sam deposits the check at Chase. The app shows funds in two days. Sam buys the cards and sends codes. A week later the check is returned unpaid. Chase reverses $3,850. The gift-card value is gone. Sam’s available balance goes negative until Sam covers the hole.
If Sam had called Chase’s official number (from the card or chase.com, not the email) and asked how long a cashier’s check can still reverse, or refused any job that requires forwarding funds, the loss would not happen.
How to verify before you deposit
- Find the company on its official site (typed, not linked). Call the main switchboard and ask whether the hiring contact exists.
- Check the email domain against the company’s real domain; freemail “HR” is a warning.
- Refuse any instruction to buy cards, wire, or crypto-send money as part of onboarding.
- If a check already arrived, ask your bank’s fraud line how long provisional credit can be reversed, and do not spend or forward any of it.
- Report attempts to ReportFraud.ftc.gov and your bank; keep copies of messages and envelopes.
Romance and “investment” overpayment variants use the same fake-check engine, different story, same math. Marketplace buyers and “employer” overpays that ask you to wire the difference: Fake overpayment check scams. Deposit-then-wire-back hiring pitches in more detail: Fake job offer deposit scams.
If you already deposited or sent money
- Call your bank/credit union fraud number from the official site or card back.
- Do not send more money to “unlock” or “recover” funds, that is a second scam.
- If you gave bank login or remote access, change passwords from a clean device and review Account takeover first-hour steps.
- File FTC and, if packages were involved, local law-enforcement reports as your bank advises.
- Monitor accounts; consider a credit freeze if you shared SSN or ID images.
Checklist
- No real job requires you to cash a check and forward the rest.
- Treat early “cleared” deposits as provisional until the bank says otherwise in writing.
- Never pay onboarding costs in gift cards, wires, crypto, or P2P to strangers.
- Verify employers through official switchboards and career pages.
- Report and freeze escalation paths if you already shared funds or identity data.
Advance fees framed as background checks, drug screens, or badge costs: Fake job background-check fee scams.
Educational only. Not legal advice. Scam tactics change. Verify employers and payment instructions through official sources and report fraud to the FTC and your financial institution.