The trick of overpaying for a bill with a direct deposit using a "stolen" cheque, altering the deposit slip to reflect a cash deposit, then trying to get a refund before the payment bounces has been around for a while.

This article in M&G gives a new twist.
Eskom on Monday warned the public of a new "refund" scam where criminals use Eskom and South African Revenue Service (Sars) letterheads to defraud large companies, businesses and individuals.

Eskom spokesperson Oupa Mhlongo said: "Scam operators use Eskom's name and forge letterheads stating that an overpayment has been made into an account and request that the money be refunded."

Mhlongo said the deposits are made with false cheques. False deposit slips are forwarded to people as proof that a deposit was made. False internet transactions are also created.

"As part of claiming the refund, the perpetrators would supply their banking details. These are actual accounts that are opened a few days before the transaction takes place using false identity documents."

Money transferred to these fraudulent accounts is withdrawn within 30 minutes by means of an internet transaction and transferred to various bank accounts, said Mhlongo.