Just tell him the whole thing seemed really strange and suspicious so you’ve called the police to have things checked out, and ask him for his full name and address. You’ll never hear from him again and the fraudulent $ will be removed at some point. The situation resolves itself.