In a pay and return scheme, what is the typical sequence of events?

• A. An employee pays an invoice twice and keeps the extra funds.
• B. An employee routes payments through a shell company to misdirect funds.
• C. An employee pays a legitimate invoice twice, requests that a vendor return one of the checks, and intercepts the returned check.
• D. An employee creates a shell company and bills the employer for fictitious services.

Answer: (C)

In pay-and-return fraud, the attacker uses normal payment processes to siphon funds by manipulating refunds. The typical sequence is to cause a legitimate invoice to be paid twice, then persuade the vendor to issue a refund by returning one of the checks, and finally intercept the returned check so they can cash or deposit it themselves. This works because it blends a legitimate payment with a legitimate refund, but the funds are redirected to the fraudster instead of back to the organization. The other described scenarios involve different fraud schemes—such as using shell companies or invoicing fictitious services—which are not about the pay-and-return flow.