At step 4, my default has always been "Please work with your financial institution to reverse the transaction." and then don't touch the money they've sent. No

At step 4, my default has always been "Please work with your financial institution to reverse the transaction." and then don't touch the money they've sent. Not touching the money and saying you are completely willing to return it but want to ensure it follows the correct process through the financial institution will protect you legally should it be an actual accident, and if it is a scam it'll disappear on its own when the scam runs out of time (bank determines you were sent money through a forged check and reverses it or something similar). Ignore any sob stories about how they need the money, the more convincing the sob story the more likely it is a scam to begin with.