A Safety Checklist for Payment-Related Messages

A message about an account, payment, refund or verification can create pressure to act quickly. A safer approach is to pause, separate the message from the action it requests, and check each detail through an independent route. The aim is not to assume that a message is genuine or fraudulent, but to verify before responding.

Start with the message itself

Readers can review the wording and context without clicking links or opening attachments. Check whether the message:

• creates urgency or threatens immediate consequences;
• asks for secrecy or discourages independent checking;
• requests a payment, a change to account details or an unusual form of verification;
• uses a sender name that does not match the surrounding details; or
• directs the reader to a channel that cannot be independently confirmed.

These signs do not prove what happened. They are prompts to stop and check. Avoid replying to the message to ask whether it is genuine, because the reply route may be controlled by the same sender.

Verify through an independent route

Instead of using contact details supplied in a suspicious message, readers can locate the relevant organisation through a source they already trust and check its current official requirements. Use a verified submission channel, and compare the instructions there with the request received.

If a verification process is relevant, follow only the current instructions shown through that verified channel. Do not guess what to provide, and do not send card images or CVV/CVC, PIN, OTP, passwords or recovery codes in KYC files, screenshots, email, chat or support requests. Normal entry into a verified payment form is different from sending sensitive payment or access information through an unverified conversation.

For a practical reference, readers can use this payment-safety checklist to organise the checks they want to make before taking action.

Keep a clear record

Note the message details, the channel used and the steps taken to verify the request. Keep records in a secure place, without copying sensitive access details into notes or screenshots. If a message includes a link, do not forward it to others as a recommendation; describe the concern and point them towards an independently verified channel instead.

If information was already shared

Stop further communication through the questionable channel and use an independently verified support route. Ask what protective steps are currently available, without repeating passwords, codes or card security details. Readers can also review their own account activity through the official service and follow its current guidance.

A careful checklist helps keep the decision with the reader. Pause, verify the route, protect sensitive information and proceed only when the request matches current official instructions.