Ilia Zavialov on the words that turn an advance payment into a procedure
Nobody asks for an advance payment by that name. The request arrives dressed as a deposit, a reservation fee, a verification transfer, a customs charge or an activation payment, and every one of those words points at a procedure that genuinely exists somewhere. The vocabulary is refreshed every season while the action underneath stays fixed: one side sends money and the other side sends a promise. This piece takes the current wordlist apart, shows where each term borrows its authority from, and marks the boundary between the real procedure and its imitation. The question worth settling before any transfer is what a person holds once the money has left.
Ilia Zavialov on the words that turn an advance payment into a procedure
One action behind a dozen names
An advance payment is money that moves before the thing it pays for is in the payer's hands. That is the entire definition, and it covers ordinary commerce as readily as fraud. A builder buying materials, a hotel holding a room and a workshop funding a production run all take money first and deliver later. The structure carries no verdict of its own.
What decides the outcome is the set of conditions around the transfer. There are four: a counterparty who can be identified afterwards, a written condition for the money coming back, a payment rail that keeps a record, and an authority to appeal to when nothing arrives. Where all four are present, an advance payment is a normal commercial instrument. Where none are present, the same transfer is a gift with a story attached.
The vocabulary is unable to tell those two situations apart, because both of them use the same words. Deposit belongs to both. Verification, clearance, activation and insurance belong to both. That overlap is why a single term can never serve as a warning by itself, and why the boundary has to be drawn by structure, which is something a wordlist cannot do.
Why the plain word is always replaced
The phrase «advance payment» carries its own risk inside it. Anyone who hears it asks the obvious follow up question, which is what happens if the other side stops answering. A substitute word removes that question by naming a process that already has an answer attached. Customs charges are settled with a state body, deposits are held under contract, verification is run by a licensed institution, so none of them appear to need a guarantee.
The borrowing is precise, and it imports three things at once. Authority, meaning the decision has already been taken by somebody with standing. Procedure, meaning a standard sequence exists and no negotiation is expected. Inevitability, meaning the payment is a step in a process already under way. A word carrying all three replaces an argument that would otherwise have to be made out loud.
This is also why the vocabulary is never stable for long. Once a term becomes known as a warning sign, it stops importing authority and starts exporting suspicion, so another takes its place. The Federal Trade Commission recorded more than a million impersonation reports during 2025, with 3.5 billion dollars in losses, close to one report in every three. A category at that scale produces new wording faster than any list can absorb it.
Deposit, the word with a genuine twin
Deposit is the strongest borrowing available, because the honest version of it is everywhere. In its real form a deposit is a part payment held against an obligation, described in a contract or a published policy, with a stated condition for its return and a named party who can be reached afterwards. Tenancy schemes and escrow accounts go further, placing the money with a third party who has no stake in the outcome.
The imitation keeps the word and drops every part of the structure. The money goes directly to the account of the person asking for it, the condition for return exists only inside a conversation, no third party is involved, and identity rests on a profile and a photograph. The word is left doing the work that documents would normally do. Nothing else in the exchange has changed, including the amount and the tone.
The boundary sits at a single question: who holds the money while the obligation is unfulfilled, and under which document. A genuine deposit survives the counterparty losing interest, because the paperwork continues to exist after the goodwill runs out. A decorative one ends the moment the messages stop arriving, and there is nowhere to take the claim.
Verification transfer, a real procedure pointed the wrong way
Verification transfer sounds technical, and it has a real ancestor. Banks and payment providers do confirm ownership of an account by moving a small amount, either by depositing a token sum and asking the customer to report the figure, or by requiring a transfer into an account the customer already controls. The direction of travel is the whole content of the procedure. Money never leaves the reach of the person being verified.
The imitation reverses that direction and keeps the vocabulary. A small amount is requested to confirm that a wallet belongs to you, that a buyer is genuine or that an account is active, and it travels to the party doing the asking. The payment verifies nothing, because a check anyone can pass by paying a fee establishes only that a fee was paid. Identity is never one of its outputs.
The boundary is drawn by asking where the money ends up and what would fail if it were never sent. Genuine verification asks for documents, a photograph against an identity page, an address record or a delay while a check runs. It costs time and paperwork. A request that asks for money and speed has borrowed the word and left the procedure behind.
Charges that appear after money has been promised
A second family of wordings belongs to the closing scene of the story. Customs charge, clearance fee, tax on the winnings, insurance of the transfer, release fee. Each arrives after a sum has already been promised to the payer, and each is presented as the last obstacle between the payer and that sum. The emotional work is done by the promise, and the word only has to sound procedural.
The structural tell is the direction of the deduction. Real charges of this kind are subtracted from the amount being paid out, because the party holding the money also collects the charge. A demand to fund a charge from a separate source in order to release a larger sum has no honest counterpart in customs handling, taxation or banking. The request describes a machine that does not exist.
Government wording is used heavily here because obligation is what it imports. The Federal Trade Commission recorded 920 million dollars lost to government impersonation in 2025 and a rise of 40 per cent in such reports, driven in part by messages about unpaid road tolls. The toll message is the compressed version of the family: a small official sounding charge, a short deadline and a payment page. The amount is kept low so that checking feels disproportionate.
The charge that multiplies
In the developed versions of these schemes the first charge is never the last. Once a payment lands, a second requirement appears with its own name: the transfer was flagged and needs clearing, the tax was calculated on the gross figure, an insurance certificate is required before release. Each new charge is justified by the one already paid. The money spent becomes the argument for spending more.
The shape of the reported losses follows from that design. The Federal Trade Commission puts the median loss on an impersonation report at around 700 dollars, which describes the ordinary case where one charge is paid and nothing follows. The long tail comes from escalating variants, where the vocabulary is renewed at every stage. A term used once can be checked in minutes, while a sequence leaves no gap in which checking feels reasonable.
That gives a rule which does not depend on the words in use this season. Any wording that produces a further payment after the first describes a process with no natural end point. Honest procedures converge on completion, and each step reduces what remains. Imitations expand, because the expansion is the product being sold.
The payment rail hidden inside the wording
A request for an advance payment almost always names a method, and the method is chosen with more care than the word. The wording performs the persuasion and the rail secures the outcome. A cryptocurrency machine, a gift card code read aloud over the telephone, cash handed to a courier and a transfer to a personal account share one property, which is that the money cannot be pulled back once it has gone.
The reporting shows how deliberate that choice is. Among people aged 60 and over who lost 10,000 dollars or more to business or government impersonation, the Federal Trade Commission recorded 33 per cent paying in cryptocurrency, 20 per cent by bank transfer and 16 per cent in cash. The FBI Internet Crime Complaint Center reports that around half of all fraud losses in the United States involve cryptocurrency. Those proportions describe a preference on the collecting side.
This produces a boundary that works even when the vocabulary is unfamiliar. An organisation that genuinely collects a charge accepts the ordinary methods it already uses, and has no interest in which one a customer picks. A request that names an unusual rail, explains why the ordinary ones are unavailable and treats speed as part of the requirement has answered the question the wording existed to conceal.
Deposits dressed as employment
The newest wrappers avoid the language of payment altogether and use the language of work. Tasks, product ratings, order batches, commission and account top up. A worker completes small actions, watches a balance rise on a dashboard, then discovers that withdrawal requires the account to be funded first, either to match a tier or to unlock more tasks. The deposit has been renamed as a condition of employment.
The growth of this wrapper shows how quickly a working formulation spreads. Task based schemes went from no reports in 2020 to five thousand in 2023, and to roughly twenty thousand in the first half of 2024 alone, about 40 per cent of every job related fraud report the Federal Trade Commission received that year. A wording that works is copied across the market within a couple of seasons.
The boundary here is older than the wrapper and outlives it. Paid work moves money towards the worker, and every step of a legitimate hiring process is funded by the employer. Any arrangement in which the worker funds an account in order to be paid from it is an advance payment in employment vocabulary. The rising balance on the dashboard is a number displayed by the party who owes it.
Purchase wording and the platform in the middle
The highest volume family uses ordinary shopping language. Hold the item, reserve it, secure it against other buyers, leave a deposit so the listing comes down. UK Finance figures for 2025 show purchase scams making up 71 per cent of all authorised push payment cases in the United Kingdom, with losses of 118.1 million pounds, up 20 per cent on the previous year. Volume concentrates here because the wording is indistinguishable from normal trade.
What separates this group is the presence of a real platform. A marketplace, a classified advertising site or a ticket exchange sits in the middle of the transaction, and the wording is used to move the payment off it. The offer to pay directly and save the platform fee is the pivot on which the case turns. Protection lives inside the payment path of the platform and nowhere outside it.
That gives the boundary its clearest form here: which system holds the record. A payment made inside a platform leaves a dispute route, a counterparty account and a policy somebody is obliged to apply. The same amount sent to a personal account leaves a screenshot and a name. The wording that moves a payment off a platform does the same job the word deposit does elsewhere.
A test that survives the next vocabulary
Lists of dangerous words go stale within a year, because the words are replaced as soon as they become recognisable. A structural test keeps working, since the structure is what the scheme requires in order to function. Four questions cover the territory: what does the payer hold at the moment the money leaves, who chose the payment method, where is the condition for return written down, and who can be reached when nothing arrives.
The test is applied before the wording is analysed, which is what makes it usable under pressure. A set of answers running a promise, they did, nowhere and a profile identifies an advance payment whatever label is attached. The same four questions asked about a hotel booking, a builder or a supplier produce a contract, a free choice of card, a published policy and a registered company. The structure separates the two cases without judging the vocabulary.
There is good reason to think the test is used successfully far more often than the loss figures suggest. In four out of five impersonation reports filed with the Federal Trade Commission no money was lost at all, so attempts vastly outnumber successes and most people stop somewhere in the middle of the script. The moment where stopping is cheap is the moment before the transfer. Its cost is a pause and four questions.
Wordings and the procedures they borrow from
Wording used
Procedure it borrows
What decides the boundary
Deposit
A contractual part payment held against an obligation
Whether a written condition for return exists and who holds the money
Verification transfer
Ownership checks run by banks with a small amount
Whether the money stays inside an account the payer already controls
Customs or clearance charge
Duties collected on imported goods
Whether the charge is subtracted from the sum or demanded separately
Tax on the winnings
Withholding applied to declared income
Whether any tax authority collects before the amount is paid out
Insurance of the transfer
Cover sold by regulated insurers
Whether a policy document with a named insurer exists
Activation or release fee
Onboarding steps at regulated institutions
Whether the fee appears before or after money has been promised
Deposit to unlock a task set
Tiered access inside real work platforms
Whether the worker funds the account in order to be paid from it
Questions and answers
How do you tell a real deposit from a fake one?
A real deposit is described in a contract or a published policy, names the condition under which it comes back, and is often held by a third party such as an escrow or a tenancy scheme. A deposit that exists only inside a conversation and travels straight to the account of the person asking has kept the word and dropped the structure.
Is a verification transfer ever legitimate?
Ownership checks by small transfer do exist at banks and payment providers, and in every genuine version the money stays inside an account the customer already controls. A transfer sent to a stranger proves nothing about identity, because anyone able to pay the amount would pass the same check.
Why do scammers ask for a customs fee before a parcel is delivered?
Because a customs charge borrows the authority of a state body and sounds like a step in a process that is already running. Real import duties are collected by the carrier against a documented calculation, and no genuine procedure requires a separate payment from the recipient to release a sum already promised to them.
Do you have to pay tax before receiving a prize or a payout?
Tax on income is withheld from the amount by whoever pays it out, or it is declared and settled later with a tax authority. A demand to send money from a separate source before a payout can be released describes a procedure that exists in no tax system.
Why does a job ask for a deposit before I can withdraw my earnings?
Because the deposit is the point of the arrangement and the tasks are the wrapper around it. Legitimate employment moves money towards the worker at every stage, and a balance shown on a dashboard is a number controlled by the party displaying it.
I paid the first fee and a second one has appeared, what does that mean?
A second charge justified by the first is the signature of an escalating scheme, in which every payment produces a fresh obstacle with a fresh name. Honest procedures move towards completion, so a sequence that keeps growing is describing itself accurately.
Written by Ilia Zavialov, digital security consultant. All glossary terms
