Please note, in most versions of such scams the perpetrator does not actually send money (as in step 1 in the OP). Instead they use some combination of fake checks (yes, printed checks!), fake "payment confirmation" emails or fake websites along with social engineering and time pressure, to make the victim think money has been sent, in the hope that they will "refund" the overpayment before realising the initial payment was not real.

So if you're reading the OP and thinking "I can just collect the money in step 1 and then ignore the refund request" (whether planning to donate yourself, or even keep it), it's not likely to work out either.