How to Avoid Payment Fraud: Shopping, Banking and Invoices

To avoid payment fraud, slow down at the moment money moves. Pay with methods that can be reversed, keep alerts on so you see every payment, never act on a request for money that arrived by surprise, and check any change of bank details by calling a number you already trust. Fraud works because it creates pressure. A few calm checks remove the pressure.

This guide covers the ways money is stolen from ordinary people and small businesses: shopping and card details, bank messages, refund tricks, fake investments, fake jobs, money mule requests and fake invoices. It is written for someone with no technical background. It will not make you suspicious of everything. It will help you know which three or four moments are worth pausing for.

A note before we start. Banks, card companies and payment apps differ by country, and so do the rules about who must refund what. Where we say "your bank", we mean the bank or provider that holds your account, and where we mention reporting, we mean the fraud team of that bank and the police or consumer body of your country. Always follow their instructions over any general guide, including this one.

Shopping and paying online

Most online shopping is safe. The risk sits in a few places: shops you do not know, payment methods you cannot reverse, and links you did not choose yourself.

Before you pay a shop for the first time, check these things:

How you arrived. Did you type the shop's address or find it through a search you made yourself, or did an advert or a message send you? A fake shop is often reached through a social media advert with an unbelievable price.
The address in the browser. Look at the full web address before you enter card details. A shop that copies a famous name often adds extra words or swaps a letter.
Contact details and policies. A real shop has a postal address, a returns page and a way to reach a person. A page with none of these, or with text copied badly from elsewhere, is a warning.
The price. A brand-new, high-demand product at half the usual price is the classic bait.
The payment method. Ask what happens if the goods never arrive.

That last question is the important one. Paying by credit card or through a trusted payment service usually gives you a way to dispute the payment. Paying by direct bank transfer, cryptocurrency or gift cards usually does not. Scammers love these methods for exactly that reason. If a seller will only accept a method you cannot reverse, stop. That is the whole message.

Worked example. You see a pair of well-known running shoes at a very low price in a social media advert. The shop accepts only bank transfer, "to keep the price low". The honest answer is that the shop does not want you to have a way back. You close the page, search for the brand's own shop, and compare. If the real price is higher, you pay the real price.

Card and banking details

Your card number, its expiry date and the three digits on the back are enough to pay in many shops. Your online banking login is enough to move money. Protect both.

Good habits:

Type your card details only on a page you reached on purpose, in a browser that shows a lock symbol next to the address. The lock means the connection is private. It does not prove the shop is honest, so use it together with the checks above.
Save cards in your phone's wallet or your browser's password manager rather than typing them into every shop. Wallets often send a one-time stand-in number instead of the real one.
Never give your full card details, your online banking password or a code from a text message to a caller or a message sender. A real bank does not ask for these.
Use a unique password for online banking. Our guide on how to protect your online accounts explains how to do that without memorising dozens.
If a bank "calls" you and you are not sure, hang up and call the number printed on your card or on the bank's own app. Do not use a number the caller gave you.

Remember that the sender name on a text can be faked and can even appear inside your real bank thread. The only safe move is to leave the message and go to the bank yourself.

Alerts and limits

Alerts are the cheapest protection you have. Open your banking or card app and look in the settings for notifications. Switch on an alert for every payment, every new payee, every login and every change of contact details. If your bank offers a spending limit or the option to freeze a card from the app, find that now, before you need it. In a bad moment you want the freeze button to be a place you already know.

Alerts also help you catch small test payments. Fraudsters sometimes take a very small amount first to see if the card works, then follow with a large one. If you see a payment you do not recognise, even a small one, call your bank. Do not wait to see if it repeats.

Limits are useful in the other direction too. If you rarely send more than a modest amount in one day, set your daily transfer limit near that level. A thief with your login then faces a ceiling. You can raise it for a day when you really need to.

Refund and chargeback tricks

Some scams use the idea of a refund to take money from you.

The "overpayment" refund. A caller or message says you were charged by mistake and offers a refund. To "process" it, they ask you to install a tool, log in to your bank or read out a code. Once you do, they move money between your own accounts so it looks as though they paid you too much, then ask you to send the "extra" back. The extra was your own money.

The fake subscription charge. An email shows an invoice for a product you never ordered, with a phone number to cancel. The number reaches a scammer who asks for remote access to "reverse" it.

The fake buyer. If you sell something, a buyer overpays by cheque or transfer and asks you to refund the difference. The first payment later fails, and you have sent real money.

The false chargeback. Fraudsters, or occasionally dishonest customers, dispute a genuine payment so the money is pulled back after you have shipped the goods. Small businesses should keep proof of delivery and proof of the order.

A simple rule covers most of these: never give someone control of your device or your bank login in order to receive money. Money does not need that. If you are owed a refund, a real company sends it to the card or account you paid from, without asking you to do anything.

Guaranteed returns and fake platforms

Investment scams look professional. They have a website, a chat contact, a dashboard that shows your balance growing, and often a friendly person who has "helped many others". The money you deposit does not go into any market. The dashboard is a drawing.

The warning signs are very consistent:

A promise of guaranteed or very high returns with little risk. Real investments carry risk and real firms must say so.
Pressure to deposit quickly, or to add more to unlock a bonus.
A contact who found you through a dating app, a messaging group or a "wrong number" text and slowly built trust.
Withdrawals that need a new fee or tax payment first.

Before you deposit anything, look the firm up in the register kept by your country's financial regulator. Search the regulator's own site, not a link the firm gave you. If the firm is not listed, or the listing does not match the name, address and website, do not go on. Our guide on how to check if an investment platform is legitimate shows the steps, including the small withdrawal test.

If you have already deposited and are being asked for more, stop paying. Money sent to unlock money is the final part of the scam.

Jobs that ask for money

A real employer pays you. A job that asks you to pay is a trap. Typical versions: a fee for training, a payment for equipment that will be "refunded", a charge for a background check, or a cheque that arrives with instructions to buy items and send the rest.

Fake cheques deserve special care. A bank may show the money in your account quickly, but that is not the same as the cheque having cleared. Days or weeks later the cheque fails, and you owe the bank the amount you spent or sent.

Check any unfamiliar recruiter before you reply. Does the company exist? Does its own website list this role? Does the person's message come from the company's real address, or a free webmail address? Our guide on jobs asking for an upfront payment goes through the checks and the signs of a fake offer.

Money mules

Some "jobs" are not about taking your money. They are about using your account. You are told that you will receive payments for the company and pass them on, keeping a share. This is called being a money mule. The money comes from other victims. You move it so that nobody can trace where it went.

People who do this are often told it is a payment processing or "finance assistant" role, or a favour for someone they met online. They may not know they are doing wrong. But in many countries it is treated as a crime even when you did not know, and your account is likely to be closed.

The rule is short. If anyone asks you to receive money and send it on, for any reason, say no. This includes people you like and trust. If you already did it, stop, keep the messages, and tell your bank and the police of your country. Acting early matters.

Invoices and bank detail changes

For small businesses, the largest losses usually come from invoice fraud. A message arrives, apparently from a supplier you know: "Our bank account has changed. Please pay the attached invoice to the new account." The email looks right. The invoice looks right. The only thing wrong is the account number.

A good procedure beats a good eye, because the fakes are good. Treat every change of bank details as unverified until you have checked it another way:

Do not reply to the email or call a number in it.
Find the supplier's number from your own records, a past contract or their official website, and call them.
Ask the person you normally deal with to confirm the change and read the new account number back to you.
Record who confirmed it and when. Let a second person approve any change before the first payment goes out.
Pay a very small test amount for a large first payment if your procedure allows, and wait for the supplier to confirm receipt.

Be as careful with invoices that are urgent, secret or oddly different: a new amount, a new currency, or a manager who says "pay this today and I will explain later". Pressure and secrecy are signs, not reasons to hurry. Our guide on what to do when a supplier changes bank details lays out the callback routine and what to log.

After money has been sent

If you realise you sent money to a scammer, act in minutes, not days. Speed is the one thing in your control.

Call your bank's fraud line at once, using the number on your card or the bank's app. Say plainly that you have been defrauded and give the time and amount.
Ask the bank what can be done for the type of payment you used. Card payments, bank transfers and payment apps all follow different rules, and the bank will know them.
Stop any further payment. Scammers often ask for a second one.
Keep every message, receipt and screenshot. Do not delete the chat.
Change passwords on any account you shared, from a device you trust.
Report it to the police or the fraud reporting service of your country.

Do not be ashamed. Skilled people are caught every day because these messages are built by professionals. The only mistake that makes things worse is waiting. Our guide on what to do after sending money to a scammer gives the full order and what each payment type can sometimes recover. Nobody can promise you the money will come back, so be wary of any "recovery service" that contacts you and asks for a fee. That is often a second scam aimed at the same victim.

Common mistakes

Choosing the payment method last. Decide how you will pay before you decide whether to trust the seller.
Believing the sender name. Names and numbers can be faked. Go to the real app or site yourself.
Letting a caller stay on the line. Hang up, then call back on a trusted number.
Treating urgency as proof. Real emergencies survive a ten-minute check.
Paying changed bank details without a callback. This is the most expensive habit in small business.
Keeping quiet. Telling the bank quickly is worth more than any amount of pride.

Questions people ask

What is the safest way to pay online?

Use a method that lets you dispute a payment, such as a credit card or a well-known payment service, and pay only on pages you reached on purpose. Avoid bank transfers, cryptocurrency and gift cards for people or shops you do not know, because they are hard or impossible to reverse.

How can I tell a real message from my bank from a fake one?

You often cannot tell from the message alone. Do not click links or call numbers inside it. Open your banking app yourself, or call the number on your card, and ask whether the bank contacted you.

Will my bank always refund me if I am scammed?

Not always. It depends on your country, the type of payment and the circumstances, including whether you authorised the payment yourself. That is why contacting the bank immediately and keeping evidence are so important. Ask the bank what its rules say in your case.

What should a small business do first to prevent invoice fraud?

Write down one rule: no change of bank details is accepted by email alone. Every change is confirmed by calling the supplier on a number from your records, and a second person approves it. Train everyone who handles payments to follow it, including when the request looks urgent.

Is it safe to give my card details over the phone?

Only when you started the call, to a number you found yourself, and you are sure of who you are speaking to. Never give card details to a caller who contacted you, however convincing they sound.

Learn this in five minutes

The track "Shopping, Banking and Digital Payments" in the DefSafe app turns these checks into short lessons. You practise paying more safely online, protecting card and banking details, setting alerts and limits, questioning refund requests and acting fast if money has gone. Each lesson takes about five minutes on your phone.