By the end of this lesson you will be able to
- Recognise fraudulent payment requests, including fake receipts, overpayments and refund tricks.
- Explain how a malicious QR code can mislead you and how to scan more safely.
- Check an online shop before buying and choose safer ways to pay.
- Follow the order of steps after a scam: stop, contact the bank, secure accounts, keep evidence, report.
- Describe why reporting helps even when money cannot be recovered.
Money is where scams end, so this lesson looks at the last step: how payments are abused and how to protect them. You will also meet QR codes, those square patterns that open a web page when scanned, because they hide the destination from your eyes. Finally you will learn what to do if the worst happens. A calm, quick response can recover money in some cases and always helps to protect your accounts. All names, shops and numbers here are invented for education.
How payment fraud works
Payment fraud means tricking you into paying, or into accepting a payment that later disappears. Criminals favour payment methods that are quick and hard to reverse, such as bank transfers, mobile-money transfers, gift cards and cryptocurrency. A card payment or a regulated payment service often has a dispute process, but a transfer you authorised yourself usually does not. That is why scammers push you towards the harder-to-reverse routes.
| Trick | How it looks | Safer response |
|---|---|---|
| Fake receipt or fake payment message | A buyer shows a screenshot or text saying they paid you, and you release the goods | Check your own balance or statement in the official app; never trust a forwarded message |
| Overpayment | A buyer pays too much and asks you to send the difference back | Do not send anything until the money has fully cleared in your account, and prefer to decline |
| Wrong transfer | Someone says they sent money to you by mistake and asks you to return it to a different account | Do not send it. Tell your bank, which can reverse its own error properly |
| Refund trick | A caller offers a refund and asks to take control of your device or to confirm your login | Ignore. Genuine refunds go to the original payment method without your help |
| Gift card or crypto demand | Any official-sounding body asks to be paid in gift cards or crypto | No genuine organisation does this. Stop |
| Changed bank details | An email from a supplier or landlord says their account number has changed | Phone them on a number you already hold before paying |
- Card or recognised payment service with dispute rights
- Protected checkout inside the platform
- Pay on delivery after inspecting goods
Easier to question or reverse
- Transfer to a personal account
- Gift cards
- Cryptocurrency
- Moving the chat off the platform
Hard to undo
Read this figure as text
A comparison of safer payment routes, with dispute rights, against risky ones, which are hard to reverse.
Safer routes: a card payment or a recognised payment service often offers a dispute process; paying on delivery for goods you can inspect; paying through the platform's own protected checkout. Risky routes: a direct transfer to a personal account; gift cards; cryptocurrency; any request to move the chat and the payment outside the platform. Risky routes are hard to undo, which is why scammers ask for them.
QR codes: you cannot read them
A QR code is a square pattern that stores a small amount of data, usually a web address. Your phone camera reads it and offers to open the address. The trouble is that you cannot look at the pattern and tell where it leads. A criminal can print a sticker with their own code and place it over a genuine one on a poster, a parking meter or a restaurant table, or send a code in an email. This is sometimes called Quishing: phishing carried by a QR code.
https://SchemeEncrypted, but not proof of honestybrightfield-shop.example.Looks like the shopOnly subdomain words in front of the real domainpay-now.exampleReal domainThe last words before the first slash show the owner/menuPathA page on that siteRead this figure as text
The anatomy of a web address with the domain name highlighted and a lookalike address that has a different domain.
A genuine address such as https://www.brightfield-shop.example/menu has the scheme https, the domain name brightfield-shop.example (the owner) and the path /menu. The figure shows a lookalike, https://brightfield-shop.example.pay-now.example/menu, in four parts: https://, then brightfield-shop.example. which only looks like the shop, then pay-now.example, which is the real domain and belongs to someone else, then the path /menu.
Safer scanning habits are simple. Use your phone's built-in camera app, which usually shows the address before opening it. Read the address and check the domain. Be suspicious of a code that looks like a sticker on top of another, or that arrives in an unexpected message. Never log in, enter card details or install an app after scanning a code you found in public; go instead to the official website or app yourself. For parking and payments, use the official app or the number printed on the machine itself.
Checking an online shop
Fake shops copy real photos and offer prices far below the market. Before you buy from a shop you do not know, run through these checks. None is perfect alone, but together they catch most fakes.
- Price. A new phone for a third of the normal price is bait.
- Address. Check the domain carefully. Misspelt or odd endings, and names with extra words, are common. A padlock only means the connection is encrypted, not that the owner is honest (see the lesson on HTTPS and suspicious sites).
- Contact details. A real shop shows a physical address, a phone number and clear returns and delivery terms. Test whether the details exist.
- Reviews. Search the shop's name with the word “reviews” on independent sites. Beware pages with only glowing, similar reviews.
- Payment. If the only choices are transfer, crypto or gift cards, leave.
- Pressure. Countdown timers and “only 2 left” banners are used to rush you.
- Step 1: PriceRealistic?
- Step 2: AddressMatches the shop?
- Step 3: ContactReal details and returns?
- Step 4: ReviewsIndependent ones?
- Step 5: PaymentProtected method?
Read this figure as text
A flow of five checks: price, address, contact details, reviews and payment method, ending in buy or leave.
Step 1: is the price realistic? Step 2: does the web address match the shop and look correct? Step 3: are there real contact details and clear return terms? Step 4: do independent reviews exist? Step 5: can you pay by a protected method such as a card or the platform checkout? If any answer is no, leave. If all are yes, you can buy, ideally with a small first order.
If you have been scammed
First, take a breath. You are not the first, and fast action matters more than blame. The order below puts money first because minutes can count.
After a scam: act in this order
Step 1: Stop all contact
Do not reply, do not send more, do not “fix it” with a second payment. Scammers often return pretending to be recovery agents who also ask for a fee.
You should see: The scammer no longer has a channel to pressure you.
Step 2: Contact your bank or payment provider immediately,
using the number on your card or in the official app. Say that you were the victim of a scam, give the time, the amount and the account that received it, and ask what they can stop, reverse or block.
You should see: You get a reference number and instructions. Some payments can be stopped if reported quickly.
Step 3: Secure your accounts
From a clean device, change the password of any account that you gave away, starting with email, turn on multifactor authentication and sign out of other sessions. If you allowed remote access, disconnect the device from the internet and follow the incident-response lesson.
You should see: The scammer can no longer sign in with what you shared.
Step 4: Keep evidence
Save messages, numbers, account details, receipts and screenshots, and write a short timeline. Do not delete anything.
You should see: You have material for the bank and the authorities.
Step 5: Report it
Tell the police or your national fraud and cybercrime reporting service, the platform or chat service where it happened, and your mobile network for scam calls and texts. Say where you live in your search for the right body, since services differ by country.
You should see: A report number, and your case is added to the picture that investigators see.
Step 6: Tell someone you trust,
and watch for follow-up scams such as fake recovery services.
You should see: You have support, and someone to help you spot repeat attempts.
Read this figure as text
A cycle of stop, tell your bank, secure accounts, keep evidence and report.
The cycle has five steps: stop contact, tell your bank, secure accounts, keep evidence, report. After reporting, you stay alert for follow-up scams and return to the start if a new contact arrives.
Common mistakes
✖ Instead of: Sending a second payment to “release” money lost in the first.
✔ Do this: More payments only deepen the loss. Stop and call your bank.
✖ Instead of: Scanning any QR code stuck on a pole or poster and entering card details.
✔ Do this: Check the address, and use the official app or website when paying.
✖ Instead of: Deleting all the messages out of embarrassment.
✔ Do this: Keep them as evidence for your bank and the police.
✖ Instead of: Trusting a shop because the padlock is shown.
✔ Do this: Check price, domain, contact details, reviews and payment method too.
If something goes wrong
- I do not know which authority to report to.
- Start with your bank and the police. Search for your country's official fraud or cybercrime reporting service, and report on the platform where the scam happened. Use only the official sites you find through the government's own pages.
- I scanned a QR code and a strange page opened.
- Close it without typing anything. If you entered a password, change it from a trusted device. If you entered card details, ring your bank. If an app downloaded, do not open it, and remove it.
- I paid by card and the goods never came.
- Contact the seller first, then your card issuer and ask about a dispute or chargeback. Keep your order confirmation and messages.
Key terms
- QR code
- A square pattern that stores data, usually a web address, which a phone camera can read.
- Quishing
- Phishing that uses a QR code to send you to a fake site.
- Scam
- A trick to get your money or details by making you believe something false.
- Multifactor authentication (MFA)
- Signing in with your password plus a second proof, such as a code from your phone.
Practise it for real
Reading is not the same as being able to do it. Complete these on your own computer, then tick only what you have actually done. These ticks are your own honest record: nothing checks them for you.
Check an invented shop
Imagine a shop called Brightfield Gadgets selling a new phone at one third of the usual price and accepting only bank transfer to a personal account. Using the five-step shop check, write down which checks it fails and what you would do. No real site is needed: this is a paper exercise.
Challenge: write your scan-and-pay rules
Write five personal rules for QR codes and payments, such as which app you scan with, what you check in the address, when you refuse to scan, and who you ring if you are unsure. Add a card-sized note with the phone number of your bank, copied from your own card or statement, and keep it with you.
Knowledge check
7 questions. You need 80% to pass. Mistakes here are part of learning, and you can retry as often as you like.
Summary
- Scammers prefer payments that are fast and hard to reverse.
- Only your own account record proves that you have been paid.
- A QR code hides its destination, so read the address after scanning and avoid logging in through codes found in public.
- Check price, address, contact details, reviews and payment method before buying.
- After a scam: stop contact, call your bank, secure accounts, keep evidence and report.
Checklist: can you do these?
Marking a lesson as read does not prove you can do it. Skills count as demonstrated when you pass the quiz (not yet) and complete the practical tasks (not yet).
Related lessons
References and further reading
Official sources for details that can change between versions.
- Phishing: how to report scam emails, texts, websites and calls (National Cyber Security Centre (UK))
- Scam alerts (Federal Trade Commission (US))