PART 1: What are overpayment scams and how do scammers prey on small tourism players?

CEBU CITY, Philippines — It all began with a picture of a child in a hospital bed, connected to an intravenous line. Her hand was wrapped with thick gauze, and her eyes were closed.  

The photo landed in the inbox of Cebuano designer Francis Sollano.

It was a pitiful image, described Sollano.  

The sender happened to be a guest, who reportedly booked a week-long stay in Sollano’s resort in Oslob, a town in southeastern Cebu, which was popular for its whale-shark watching activities.  

She goes by the Facebook username Mariyah Nhame but her real identity remains a mystery — for now. But for the purpose of this report, we will be referring to her as Mariyah.  

Mariyah claimed to have booked seven nights in Sollano’s resort, but she decided last Sept. 13, 2022 to cancel one night. Her reason? Her niece, the one captured in the photo, was hospitalized.  

They needed funds to pay her bill as soon as possible, she purported.  

A night in the exclusive, beachside resort that Sollano operates costs P2,888 on the weekdays and P3,888 on the weekends. The three beach cabins dotting the entire property can altogether accommodate up to 15 people. 

Mariyah further said to have paid the downpayment of P20,000, and she wanted a refund as soon as possible. Normally, Sollano would wait for verification from the bank, that the client’s transaction was successful, before granting a refund.  

“They needed the money, they needed cash. It was urgent and at the same time, saddening to see a child suffering like that. No parent would want to see a child in that kind of situation so, out of the goodness of our hearts, I told my staff to give her the cash refund immediately,” Sollano said in Cebuano.

So, they sent P1,200 to Mariyah to a GCash e-wallet Account Number (0950 980 3373) under the coded name Ke*** L.  

But Mariyah was just part of what seemed like a syndicate involving posers and grifters who scam owners of small resorts, vacation rentals, and other businesses here in Cebu and other parts of the country. 

Their strategies primarily involved overpayment scams and identity theft, and Sollano was not the first who fell victim to these.  

A quick search of Mariyah’s Facebook username, and other aliases linked to her, would generate dozens of posts from small businesses, warning other netizens about her fraudulent activities. Some of these even dated back as far as 2021.  

Others were fortunate enough to detect her suspicious behavior before she could take some money from them.  

Here’s How They Scam Small Tourism Players

Contact 

Mariyah, or whoever is behind her identity, sends a message informing property staff and owners that she, or someone else she’s representing, would like to make a reservation. In Sollano’s case, she claimed to have already made a reservation.  

She would then send a bank transfer receipt, indicating that she has paid the downpayment. However, this would later turn out as fake.  

Mariyah sent a forged bank transfer receipt to Sollano to give him the impression that she had already deposited P20,000 to his bank account.  

Screenshots contributed by Francis Sollano

Urgency  

She would then say that she had to cancel her booking and would quickly send the picture of a child lying on a hospital bed, and further claim that it was her niece so she need funds urgently.  

“Usually, we would wait for verification from the bank that the transfer was successful and deposited in our account. But that instance, we made a special case for her… so we decided not to wait for the bank confirmation, and released the refund,” Sollano explained.   

The image of the hospitalized child was the same image a certain Marl Dario, who operates a campsite in Luzon, received from Mariyah.  

Fortunately for Dario, according to his Facebook post warning the public about Mariyah, he did not give in to the scammer’s demands and pity.  

In his post, Dario said the amount Mariyah insisted to have paid for her reservation in their campsite did not reflect in his bank account, prompting him to ignore her persistent requests. 

Mariyah also tried to dupe the management of Sol Dia Apartelle, a small vacation rental based in Santa Fe, Bantayan Island, Cebu.  

Santa Fe is also a tourist favorite in Cebu, notably for its stretch of pristine, white-sand beach drawing thousands of tourists annually. 

Sol Dia Apartelle began welcoming guests to their property in 2021.  The basic accommodation they offer costs around P950 per night while their most expensive, a two-bedroom apartment, is approximately P2,400. 

The two-bedroom apartment comes with a kitchen, fridge, dining area, and separate restrooms. 

Last Sept. 3, one of Sol Dia Apartelle’s managers, Miranda, received Mariyah’s request for a refund. The scammer claimed to have booked a three-night stay on their property and sent an ‘overpayment’ for her reservation. 

Miranda, who requested to keep her anonymity for security reasons, said they checked with their online banking app to see if Mariyah’s claims of transferring at least P15,000 were true.

Sure enough, Mariyah lied to them.  

Sollano would eventually encounter the same script Mariyah used in an attempt to scam the managers of Sol Dia Apartelle. This time, however, it seemed like she was using another alias.  

Barely a day after transacting with Mariyah last Sept. 13, Sollano received another message from his staff saying that a certain Jennifer, claiming to be based in Delaware in the United States, allegedly wired P20,000 to his bank account as a downpayment for her reservation. 

She told Sollano she needed portions of the money back as the downpayment for her booking only amounts to around P13,000. She claimed the excess P7,000 was a remittance intended for her sister, Sofia.   

“It’s not unusual for guests to pay extra in their downpayment so that they would pay less upon arrival,” Sollano added.  

Monetization 

Jennifer even went as far as saying that the first money transfer Sollano’s staff initiated, amounting to P5,300, went to the wrong account, and requested another refund of P7,000.  

Sollano released more than P12,000 as a cash refund, unaware that Jennifer was not the person he thought would be.  

Like those of Mariyah, Jennifer’s bank transfer receipts were manipulated to look like the transaction was successful when in fact, it never happened.  

“Later on, it made me suspect whether this was just one person or a work of a group, doing the same scam,” Sollano added.  

The Refund / Overpayment Scam

The type of scam Mariyah and Jennifer used to bait small tourism players like Sollano, Dario, and Miranda is called an overpayment scam.  

Wikipedia defines overpayment scam as a kind of confidence trick that preys on an individual’s good faith. Hence, Mariyah’s tactic of using a photo of a hospitalized child.

Screenshot contributed by Francis Sollano

“In the most basic form, an overpayment scam consists of a scammer notifying the victim that they have accidentally been sent an excess of money,” it says.  

Online refund scam, like the one demonstrated by Mariyah to Sollano, is a type of overpayment scam as the transaction usually consummates in the scammer getting a ‘refund’ from the victim. 

The reason why Miranda ignored Mariyah’s demand for a refund was that she already learned how overpayment and online refund scams work, way back in 2021.  

Miranda believed Mariyah, using a different alias, was the same person who took P650 from them last year. 

Just three months after they began their operations in April 2021, Miranda came in contact with a woman, whose username is O’c Eje’zzie, on Facebook.  

She said O’c Eje’zzie requested a refund when she reportedly sent P3,000 for a three-night stay in their apartment. It was over P650 than her total bill, Miranda explained.  

Like how Jennifer scammed Sollano, Eje’zzie would not stop pestering Miranda for her refund request. 

Opting for convenience and peace of mind, the resort manager decided to give the scammer what she wanted, even if their bank account showed that Eje’zzie’s supposed transfer was not there.  

“I felt bad for giving in to her demands. Unya kana bitaw dali-dalion ka para masent nimo dayon. (And then she would keep pressuring you to send her the refund immediately),” explained Miranda.  

Disengage 

Miranda tried to message Eje’zzie again, asking her why the P3,000 she reportedly sent as downpayment was not posted by the bank. The latter, however, no longer responded, and fearing that she had been scammed, Miranda blocked Eje’zzie.  

“That P650 may seem small to us but if she manages to scam a lot of small businesses, it’s huge,” Miranda said in Cebuano.  

O’c Eje’zzie was also the subject of numerous posts on Facebook. Most of them, dating back to 2021, were made to alert the public about her fraudulent activities.  

At that time, most of her victims happened to be small restaurants, local coffee shops and milk tea stores, and other food service providers.  

Based on the Messenger conversations Miranda had with Eje’zzie, which she shared with CDN Digital, the scammer claimed to be an employee of Synchrony, a company she apparently made out of the blue.  

It was almost the same company name Mariyah used to scam an owner of a vacation rental in Davao last Sept. 12, 2022.  

A public post on Facebook from Belle Umanan-Limpot showed that Mariyah took away P1,480 from them after claiming to have sent an ‘overpayment’ for her reservation.  

Mariyah told Umanan-Limpot that the booking was for a company-sponsored outing, and the company’s name was Synchrony Elms Corporation.  

Back in Oslob, another would-be guest in Sollano’s resort wanted to back out, and get a refund.  

This time, he told the designer and resort owner that they need the money back, which he claimed to have paid as a downpayment for a company-funded, team-building activity.  

Sollano, at this point, started to question the timing of all the refunds they issued.  

“It already sounds fishy. Like these really can’t be a coincidence? But then I decided to connect the dots. I told my staff to do a little digging and that’s when we found out we have been scammed,” he said.  

In total, Mariyah and Jennifer took away close to P15,000 from Sollano’s resort business. 

Identity Theft

While transacting with their victims, Mariyah, Jennifer, and Eje’zzie would also commit identity theft to make it appear that their intentions were honest and legitimate.  

When Jennifer contacted Sollano for a refund request, she used a manipulated PhilHealth ID that allegedly belonged to her sister, Sofia.  

In Miranda’s case, Mariyah told her that the reservation for Sol Dia Apartelle shall be filed under the name Christine Joy Villanueva. She also presented a fake passport photo to back her claims.   

However, a certain Christine Joy Villanueva took to Facebook to alert everyone that a manipulated passport photo bearing her name was being used to defraud people.  

Although Villanueva did not name Mariyah and Eje’zzie, the fake passport picture she posted was the same one Mariyah used in an attempt to scam Miranda again. 

A nurse namely Aimee Lou Roque also shared on Facebook that her photos, as well as her Professional Regulations Commission (PRC) License Number, were being used to con unsuspecting individuals. Roque’s name was dragged in the scam notices linked to Mariyah. 

Mariyah’s Facebook account was last seen active on Sept. 20, 2022. As of Sept. 25, however, her account cannot be found anymore on Facebook.  

The latest Facebook post warning about her fraudulent activities was published on Sept. 28. 

TO BE CONTINUED