You asked,
what can go wrong?
It's hard to give a specific answer, other than to say, "lots of things."
It's important to remember that scams generally don't happen in a vacuum. That is, scammers are typically running many different kinds of scams and using them to fuel each other. If someone deposits money into your account, it's likely that it was stolen/scammed money, or "fake" money generated from a different scam against a different victim.
For instance, a scammer may use social engineering to obtain a username and password for someone's online banking login. Then, using that account, they install the bank's mobile app on their own phone, and use the bank's remote deposit capture feature to make a deposit of a fake or stolen check. By leveraging things they know about how that particular bank clears a check, they then transfer some or all of the deposited funds to a different account, before the bank is able to discover the scam and reverse the deposit.
Essentially, that attack gives the scammer a small amount of fake money to play with. They can then deposit this fake money into another account, and con that victim into doing something with the money (i.e. transferring it to yet another account, sending it via un-traceable or non-reversible methods to another account, so on).
Generally speaking though, scams are built around chaining victims together to accomplish two core features:
- Hiding the identity of the scammer. By gaining access to a victim's account, the scammer can use that account to carry out a scam, without it being traceable to them.
- Exploiting the differences in how various transfer/deposit/payment features are (or are not) reversible and the timing differences between them in terms of how funds are cleared - this allows a scammer to turn fake money into real money.
To bring this full circle and answer the question in your title,
How does “you got some unknown money” scam work?
The scam works for the scammer when they combine the deposit into your account with various other scams against various other accounts. Your deposit may be part of the "final" scam, in which case the scammer may contact you directly and ask you to do something with the money (sometimes this is via a phishing email or phone call meant to impersonate your bank). Or, your random deposit may be a middle step in a larger scam, in which case it may disappear on it's own - when the original transaction is reversed by the scammer in order to pull money back into the originating account, or when the scammer breaks into your account and moves the money out themselves via another means.
Of course, it's also possible that the money was deposited by accident or by mistake. At the end of the day, if unexpected money shows up, the best thing to do is contact your bank and let them know, then comply with their instructions.
