Payment scams that target freelancers: overpayments, fake checks and changed bank details (US, UK, Canada)

A new client pays too much and asks for the difference back. A "payment pending" email wants you to click a link first. Your client gets an email from "you" with new bank details. Here's how these scams work, what the FTC, the UK's National Cyber Security Centre and the Canadian Anti-Fraud Centre say, and what to do.

General information, not legal or financial advice. Not written or reviewed by a lawyer. The scam table, the reporting summary, the step-by-step table and all the wording to copy are ours; the official items come from the US, UK and Canadian government pages linked below. They are general fraud warnings for any person or business, and none of them is a freelance law. Banks' own rules, payment apps' rules and other countries were not checked. Official pages were read on 2026-10-16.

The short answer

1. If anyone pays you more than they owe and asks you to send the difference on, it's a scam. Don't send anything.
2. Money showing in your account isn't proof a payment is good. The FTC says a fake check can take weeks to be found.
3. A payment notice that asks you to click, scan, ship first or pay a fee is not a payment. Check your account directly.
4. Treat any "our bank details have changed" message as suspect. Confirm on a phone number you already have, and tell your clients in writing that yours won't change by email.
5. The IRS and the CRA say a genuine contact won't threaten you or demand instant payment (the CRA names gift cards and crypto). HMRC only emails about refunds or payment details from an address ending in hmrc.gov.uk.
6. If it's happened, call your bank first, then report it (section eight).

On this page

• 1. The scams freelancers meet most
• 2. Overpayments and fake checks
• 3. Fake payment notices
• 4. "Our bank details have changed"
• 5. Fake invoices, listings and briefs
• 6. Fake tax office contacts
• 7. Protect your email
• 8. If it happened: who to tell
• 9. Step by step
• 10. Wording to copy
• 11. Checklist
• Free tools and kits
• Where the sources differ
• When to get advice
• Related
• Sources

1. The scams freelancers meet most

The UK government's Stop! Think Fraud campaign: "If you are self-employed or running a business, fraud and cyber security should be high on your agenda." (Stop! Think Fraud: Protect your business from fraud, no page date shown). The FTC sums up how most of these work:

• Scammers pretend to be someone you trust. They impersonate a company or government agency you know to get you to pay. But it’s a scam.
• Scammers create a sense of urgency, intimidation, and fear. They want you to act before you have a chance to check out their claims. Don’t let anyone rush you to pay or to give sensitive business information.
• Scammers ask you to pay in specific ways. They often demand payment through wire transfers, cryptocurrency, or gift cards. Don’t pay anyone who demands payment this way. It’s a scam.

(FTC: Scams and Your Small Business, dated July 2023 on the page).

Our summary of the ones that come up when you sell your own services (not an official list):

2. Overpayments and fake checks

• How it works (US): "In a fake check scam, a person you don’t know asks you to deposit a check. It’s usually for more than they owe you, and it’s sometimes for several thousand dollars. They tell you to send some of the money back to them or to another person." "They always have a good story to explain why you can’t keep all the money. They might say they need you to cover taxes or fees for a prize, to buy supplies for a job, to send back money they overpaid, or something else. But this is a scam." (FTC: How To Spot, Avoid, and Report Fake Check Scams, dated June 2025 on the page). The FTC's small business guide describes the same thing: "Some scammers give you what seems like a plausible reason to overpay you with a check. Then, they’ll ask you to send the extra money back to them or to someone else. But the check will be fake, even though it might show up as “cleared” in your account. By the time the bank discovers the check was bad, the scammer already has the money you sent them. You’ll be stuck repaying the bank." (FTC).
• Why "it cleared" doesn't help: "These scams work because fake checks generally look just like real checks, even to bank employees." "By law, banks have to make deposited funds available quickly. Even if you see the funds in your account, that doesn't mean it's a good check." "Fake checks can take weeks to be discovered and untangled. By that time, the scammer has any money you sent, and you’re stuck paying the money back to the bank." "Your best bet: Don’t rely on money from a check unless you know and trust the person you’re dealing with." (FTC).
• Canada: the CAFC's vendor fraud warning: "You receive a payment for more than the asking price. The fraudster asks you to deposit the funds and wire the excess funds immediately back to them. After sending the funds, you discover that the payment was fraudulent." "Fraudsters use compromised bank accounts, fraudulent cheques and stolen credit cards in overpayment frauds." (CAFC: Merchandise, vendor fraud, page date 2026-01-16).
• What the FTC says to do: "Don’t accept a check for more than the selling price. You can bet it’s a scam." "Never use money from a check to send gift cards, money orders, cryptocurrency, or to wire money to anyone who asks you to." "Gift cards are for gifts, not payments. Anyone who demands payment by gift card is always a scammer." (FTC).

Our reading for freelancers: the "selling price" is your invoice. A real client who overpays by mistake can cancel and pay again, or wait while you return it the way it came once your bank confirms the payment. Anyone who wants the difference sent somewhere else, fast, is the warning sign. If you work with clients abroad, the same applies to foreign payments (see invoicing international clients).

3. Fake payment notices

• Pending payments: "If you've posted an online ad for yourself or your business, you may be contacted by a fraudster." "You receive a message or email money transfer notification that claims the payment is pending." In the CAFC's example the seller is told to ship first: "You ship the item and provide the tracking number, only to discover that the payment notification is spoofed and no payment is pending." (CAFC).
• QR codes and fake e-transfers: "Fraudsters will send a fake payment advising that the victim must scan the QR code in order to receive a payment." "Fraudsters will send a fake "etransfer" email or text message asking you to accept a transfer as payment. The email looks official, but the fraudsters want to steal your banking credentials to access your bank accounts and steal your money." "How to protect yourself:"
  • verify URLs/ web addresses before clicking on links
  • know that email addresses and text message numbers can be spoofed
  • never share your security code (multi-factor authentication) with anyone
  (CAFC).
• Links and attachments (UK): "Do not give out private information (such as bank details or passwords), reply to text messages, download attachments or click on any links in emails if you’re not sure they’re genuine." (GOV.UK: Avoid and report internet scams and phishing, page date 2024-10-11).

The CAFC's examples are about selling goods; we've applied them to services. In practice: a payment is real when it's in your account and your bank or payment provider shows it, not when an email says so.

4. "Our bank details have changed"

This one runs both ways. A scammer can pretend to be you and send your client new bank details, or pretend to be someone you pay.

• UK: "Payment diversion fraud is one of the most damaging scams facing UK businesses today. Criminals deceive staff into sending money to the wrong bank account." "Invoice fraud: Fraudsters hack supplier email accounts or create lookalike domains to send fake invoices with updated bank details." What to look out for:
  • Unexpected or urgent payment requests
  • Requests to change bank details, especially near holidays or deadlines
  • Attempts to bypass normal approval processes
  (Stop! Think Fraud). The NCSC: "Cyber criminals may trick you by sending an email tailored to your organisation, impersonating someone you correspond with regularly, so it looks like you are dealing with a legitimate contact. They may send an invoice that looks real but contains a virus, or ask you to pay money into a different bank account." "This type of scam is an example of business payment fraud. It is also known as Business Email Compromise (or BEC)." (NCSC: Business payment fraud, no page date shown).
• Canada: "Fraudsters will infiltrate or spoof a business or individual's email account and create a rule to send copies of incoming emails to one of their own accounts." "Fraudsters launch their attack when the owner of the email account can't be easily contacted by email or by phone." "It may look like a top executive sending an email to their accounts payable department requesting an urgent payment to close a private deal or it may look like an email from existing contractor providing new payment directions and requesting payment of an invoice." (CAFC: Frauds targeting businesses, page date 2026-01-16). Its spear phishing page describes the "A fraudster targets businesses that have an existing relationship with a supplier, wholesaler or contractors. They send a spoofed email informing the business of a change in payment details. The email provides new banking information. It requests that the business make future payments to this "new" account." and adds: "The sender's address appears to be the actual email address of the source they're pretending to be, a tactic known as spoofing." (CAFC: Spear phishing, page date 2026-01-16).
• US: "A scammer sets up an email address that looks like it’s from your company. Then the scammer sends out messages using that email address. This practice is called spoofing, and the scammer is what we call a business email imposter." (FTC: Cybersecurity for Small Business, dated September 2025 on the page).

What they say to do:

• "It is rare for businesses to change bank accounts. Treat any request to do so with caution." "Always confirm both old and new account details using a known phone number – not one provided in the message." And, for you as the supplier: "If you are a supplier, make sure your terms explain how you’ll notify customers of any changes to payment details." (Stop! Think Fraud).
• Some of the CAFC's tips under "Spear phishing fraud and payment redirections" (a selection; the page has more):
  • Put in place detailed payment procedures including verbal authentication for any urgent requests or changes in payment details
  • Encourage a verification step for unusual requests
  • Take a few seconds to hover over an email address or link and confirm that they are correct
  • Restrict the amount of information shared publicly
  (CAFC). And: "If you're unsure, look up the person's email or phone number in your work's directory and verify with them if they sent the message." (CAFC).
• "Implement verification policies. Put internal policies in place for verifying certain requests. For example, require your employees to call and confirm wire transfer requests that they receive through email." If someone is using your business's name: "If you find out scammers are impersonating your business, tell your customers as soon as possible. If you email your customers, don’t include hyperlinks." (FTC).

For a one-person business, "verbal authentication" means a quick call on a number you already had before the message arrived. Put the promise in your terms and on every invoice; section ten has wording. What else goes on an invoice: invoice fields. Agreeing payment details at the start: client onboarding.

5. Fake invoices, listings and briefs

• Bills for things you never ordered: "Scammers create phony invoices that look like you ordered products or services for your business. They hope the person who pays your bills will assume the invoices are real and make the payment. Except it’s all fake." "Scammers try to fool you into paying for nonexistent advertising or a listing in a phony business directory." (FTC).
• Government and trademark look-alikes (US): "Scammers say they’re a government agent and threaten to suspend your business licenses, fine you, or even sue you. They might say it’s because you owe taxes or need to renew a license or registration." "Scammers impersonate the U.S. Patent and Trademark Office and threaten that you’ll lose your trademark if you don’t pay a fee immediately." (FTC). If you've registered a business name or a trade mark, see choosing and registering a business name.
• Fake requests for quotes (UK): "Fraudsters may create fake calls for tenders or quotes with the aim of gaining access to your systems." "Always verify tenders via the company’s official website." (Stop! Think Fraud).
• Checking a new client: the FTC: "Before doing business with a new company, search the company’s name online with the term “scam” or “complaint.” Read what others are saying about that company." (FTC). Stop! Think Fraud: "When doing business with new business customers, be cautious of setting up credit accounts or providing services prior to payment, particularly for companies that have recently been incorporated." (Stop! Think Fraud). A deposit before you start is one way to do that; see deposits in your payment terms and freelance deposits and retainers.

6. Fake tax office contacts

• US (IRS): "A phone call, email or text message isn’t from the IRS if it:"
  • Is unexpected
  • Rushes you
  • Threatens you
  • Asks for personal or financial information
  • Demands payment now
  "A social media direct message is never from us." "We normally contact you the first time by mail delivered by the U.S. Postal Service." "We email only when you opt in." (IRS: How to know it’s the IRS, page date 30-Sep-2026). The IRS also lists this one: "Scammers send you a tax bill to trick you into paying them." (IRS: Recognize tax scams and fraud, page date 07-Apr-2026).
• UK (HMRC): "HMRC will only ever email you about a tax rebate or ask for personal or payment information from an email address that ends in hmrc.gov.uk." "HMRC will never send a notification of a tax rebate or ask you to disclose personal or payment information by text message." (HMRC: Report suspicious HMRC emails, texts, social media accounts and phone calls, page date 2025-11-24). Stop! Think Fraud, on tax and VAT scams: "It could be a scam if it:"
  • rushes you or gives you a tight deadline
  • is threatening
  • is unexpected
  • asks for information like bank details
  • tells you to transfer money
  • offers a refund, tax rebate or grant
  (Stop! Think Fraud).
• Canada (CRA): "The CRA will not:"
  • Send refunds or payments by e-transfer or text message
  • Provide or accept payments by cryptocurrencies
  • Demand or pressure immediate payment by:
    • Interac® e-transfer
    • Cryptocurrencies
    • Prepaid credit cards
    • Gift cards from any type of retailer
  • Threaten to deport or arrest you, or put you in prison
  • Use aggressive or threatening language
  • Set up an in-person meeting in a public location to collect a payment
  • Charge a fee to speak with a call centre agent
  • Ask for personal or financial information in a voicemail or email
  "Emails you receive from the CRA will not:"
  • Be from a specific user
  • Ask you to reply to the email
  • Include a link asking you to enter personal or financial information
  "The CRA will not use text messages or instant messaging such as Facebook Messenger or WhatsApp." (CRA: Recognize a scam, page date 2026-10-09).

If in doubt, don't use the phone number or link in the message: go to the tax office's own website and contact it from there.

7. Protect your email

Most of these scams start in an inbox. The NCSC: "If a criminal hacks into your business email account, they could:"

• access private information about you (including your banking details)
• post emails and messages pretending to be from you (and use this to trick other people)
• gain access to other accounts (for example by resetting passwords)

(NCSC: Small organisations guide, Secure your email, no page date shown). It recommends a separate password ("That is, use a password that you don’t use for any of your other accounts, either at home or at work.") and two-step verification: "2SV, which is also known as two-factor authentication, keeps cyber criminals out of your accounts even if they know your passwords." (NCSC).

If your email is on your own domain, the FTC adds: "Use email authentication. When you set up your business’s email, make sure the email provider offers email authentication technology." (FTC). Ask your email provider how to set it up. Your wider security duties for client data, and what to do after a breach, are in our data protection guide (see also personal data breaches).

8. If it happened: who to tell

First, your bank. The NCSC: "Contact your bank directly, and make sure you use their official website or phone number" (NCSC). Then report it:

• US: "If you spot a scam, report it to ReportFraud.ftc.gov. Your report can help stop the scam." (FTC). For a spoofed business email: "Report the scam to local law enforcement, the FBI’s Internet Complaint Crimes Center at IC3.gov, and the FTC at ReportFraud.ftc.gov." (FTC).
• UK: "Contact Report Fraud if you think you’ve lost money or been hacked because of an online scam or fraud and you’re in England or Wales." "If you’re in Scotland and you’ve lost money because of an online scam or fraud, report the crime to Police Scotland." "Forward suspicious emails to report@phishing.gov.uk." (GOV.UK). For messages that mention HMRC: "Forward suspicious emails to HMRC’s phishing team: phishing@hmrc.gov.uk then delete them." (HMRC).
• Canada: "If you have been a victim of fraud or cybercrime, please contact your local police as soon as possible." "Whether you are a victim or a witness, you can report a fraud or cybercrime online at reportcyberandfraud.canada.ca." "It is also recommended that you report the instance of a fraud or cybercrime, whether you are a victim or not, to the CAFC." (CAFC: Report fraud and cybercrime, page date 2025-11-27).

Our summary, based on the pages above (not official wording):

The official pages also give phone numbers for reporting; use the ones on those pages. If a scam stopped a real client paying you, our guide to chasing an unpaid invoice covers the follow-up.

9. Step by step

Our suggested habits (general practice, not an official list):

10. Wording to copy

Replace everything in [brackets]. This is ours, not from any government page, and it's not legal advice.

A payment-details notice for your invoices and contract

How to pay: [bank transfer / payment link / other method], to [account name and details].
These payment details will not change by email or text. If you ever get a message saying they have, please don't pay. Call me first on [the phone number you already have for me].

It does what Stop! Think Fraud asks of suppliers: it tells clients how you'll handle a change. Put the same line in your contract's payment terms.

Reply to an overpayment

Subject: Your payment for invoice [invoice number]

Hi [name],

The payment I received is more than the invoice total of [invoice total]. I'm not able to send the difference to you or to anyone else, or to pay a third party from it.

Please cancel that payment and send [invoice total] instead, by [the payment method on the invoice]. I'll start [the work / the next stage] once the correct payment has reached my account and my bank has confirmed it.

Thanks,
[Your name]

Warning a client about fake bank details

Subject: Please don't pay: that message about my bank details wasn't from me

Hi [name],

My bank details have not changed. If you've had a message, invoice or call saying they have, please don't send money to the account it gives, and don't reply to it.

The only details to use are the ones on [my original invoice / our contract]: [account name and details]. If anything about a payment to me ever looks different, call me on [the phone number you already have for me] before you pay.

If you've already paid the new account, please contact your bank straight away.

Thanks,
[Your name]

11. Checklist

• Your payment method and details are in the quote or contract, with a line saying they won't change by email.
• The same line is printed on every invoice.
• New clients looked up through their own website before you start, and a deposit asked for where it makes sense.
• No money sent on, refunded or spent until your bank confirms the payment is genuine.
• Any overpayment: ask the payer to cancel and pay the right amount; nothing sent to a third party.
• Any change to bank details confirmed on a phone number you already had.
• Your email has a separate password and two-step verification.
• You know who to call first (your bank) and where to report (section eight).

Free tools and kits

• Our free invoice generator runs in your browser; nothing you type is sent or saved. Add the payment-details notice to its notes.
• Our paid Freelance Billing Kit by Small Rows (US$12, one-time) has one "Payment details printed on invoices" setting that prints on every invoice, so a notice like the one in section ten goes out with each one. Its Invoices tab marks an invoice Paid once the amount paid you type reaches the total, so type it only when you're sure the money is really yours. It doesn't check payments, read your bank account or spot scams.
• Our paid Quote & Proposal Kit by Small Rows (US$12, one-time) can ask for a deposit on acceptance, and its example terms say work starts once the deposit is received. It doesn't check who the client is.
• Our paid Client & Project Tracker by Small Rows (US$12, one-time) keeps each client's email and phone number on its Clients tab, so you have contact details you already know when a payment request or a "new bank details" message looks odd. It doesn't check whether a message or a payment is real.
• All three kits together: the All-Kits Bundle by Small Rows (US$24, one-time).

Where the sources differ

• Names: the NCSC calls changed-bank-details scams "business payment fraud" (or BEC), Stop! Think Fraud calls them "payment diversion fraud", the CAFC "spear phishing" and "payment redirections", and the FTC talks about "business email imposters". They describe the same kind of scam.
• Who they're written for: the FTC's fake check page and the CAFC's vendor fraud page are written for people selling things; the business pages assume you have staff and an accounts team. We've applied them to a one-person business selling services.
• Page dates: the NCSC and Stop! Think Fraud pages show no date, and the FTC small business guide is dated some time ago; the advice may still be current. Check the live page before relying on it.
• What we did not check: how long banks in each country may hold a deposit, or when a payment becomes final (no official page was read on this); chargebacks and card disputes; the rules of payment apps and platforms; state, provincial and territorial consumer protection rules (including Quebec); Northern Ireland reporting; insurance; the EU and other countries.

When to get advice

• you've sent money, goods or work and think it was a scam (call your bank first);
• a payment you received has been reversed or taken back;
• someone used your name or email to send invoices to your clients;
• a client paid a scammer and says they've paid you;
• your email or business accounts may have been hacked;
• a "tax office" says you owe money and you're not sure it's genuine.

Talk to your bank, the police or the reporting services in section eight, and a lawyer where you work if money or a client relationship is at stake. This page is general information only.

Related

• How to write a freelance invoice
• Invoice payment terms explained
• Freelance deposits and retainers
• Freelance client onboarding checklist
• How to chase an unpaid freelance invoice
• Data protection for freelancers
• How to invoice international clients

Sources

• United States: FTC: How To Spot, Avoid, and Report Fake Check Scams (dated June 2025 on the page) · FTC: Scams and Your Small Business, A Guide for Business (dated July 2023 on the page) · FTC: Cybersecurity for Small Business, Business Email Imposters (dated September 2025 on the page) · IRS: How to know it’s the IRS (page date 30-Sep-2026) · IRS: Recognize tax scams and fraud (page date 07-Apr-2026)
• United Kingdom: NCSC: Business payment fraud (no page date shown) · NCSC: Small organisations guide to cyber security, Secure your email (no page date shown) · Stop! Think Fraud (Home Office campaign): Protect your business from fraud (no page date shown) · GOV.UK: Avoid and report internet scams and phishing (page date 2024-10-11) · HMRC: Report suspicious HMRC emails, texts, social media accounts and phone calls (page date 2025-11-24)
• Canada: Canadian Anti-Fraud Centre: Frauds targeting businesses (page date 2026-01-16) · CAFC: Merchandise (vendor fraud) (page date 2026-01-16) · CAFC: Spear phishing (page date 2026-01-16) · CAFC: Report fraud and cybercrime (page date 2025-11-27) · CRA: Recognize a scam (page date 2026-10-09)

Checked 2026-10-16. Found a mistake? Tell us via Support.