← Back to Knowledge Center
KNOWLEDGE CENTER

Financial Scam Response: What to Do After a Suspicious Payment

Incident Responseen-NG
BEFORE YOU BEGIN

Understand the issue before you decide what to do.

This lesson is designed to explain the subject in practical terms so that you can understand not only what the risk is, but why it matters, how it can appear in real situations and what you can do to reduce your exposure.

Read the explanation carefully before acting on a suspicious message, request, transaction, account notification or other security-related situation.

FULL LESSON

Understanding the subject

Take your time with this explanation. The goal is not simply to recognise a warning sign, but to understand what is happening and make a safer decision when you encounter it.

FINANCIAL SCAM RESPONSE: WHAT TO DO AFTER A SUSPICIOUS PAYMENT

If you realize that you may have sent money to a scammer or authorized a suspicious transaction, act promptly—but do not let panic push you into another unsafe action.

THE CORE PRINCIPLE

AFTER A SUSPICIOUS PAYMENT, SPEED MATTERS—BUT VERIFICATION STILL MATTERS.

01 · STOP FURTHER PAYMENTS

Do not send additional money because someone claims it is required to release, reverse or recover the first payment without independently verifying the claim.

02 · CONTACT THE PAYMENT PROVIDER

Use the bank, wallet provider or payment service's trusted official channel. Explain that the transaction may be fraudulent and provide the relevant transaction information.

03 · SECURE RELATED ACCOUNTS

If account credentials or authentication information may have been exposed, secure the affected account and review sessions and recovery methods.

04 · PRESERVE TRANSACTION INFORMATION

Keep transaction references, receipts, messages and relevant account information. Avoid deleting useful evidence before recording it.

05 · BEWARE OF RECOVERY SCAMS

People who have already lost money can be targeted again by fake recovery agents promising to retrieve funds for an upfront fee or by requesting sensitive credentials.

06 · REPORT APPROPRIATELY

Use the relevant provider's reporting process and, where appropriate, local law-enforcement or regulatory channels.

EXAMPLE

After sending money to a fraudulent beneficiary, someone contacts you claiming they can recover it if you pay another fee and provide account credentials. Do not proceed without independent verification. Contact the original payment provider through its official channel instead.

WHAT TO DO

  • Stop additional payments.
  • Contact the provider promptly.
  • Secure affected accounts.
  • Preserve evidence.
  • Ignore unsolicited recovery offers until independently verified.
  • Report through appropriate channels.

WHY THIS MATTERS

A financial incident can create a second wave of fraud if attackers convince the victim that another payment or secret is necessary for recovery.

VERIFY BEFORE YOU TRUST.

APPLY WHAT YOU LEARNED

Turn understanding into a security habit.

Knowing the definition is only the beginning. The real value of cybersecurity education is being able to recognise the situation and make a safer decision when it happens to you.

How should you use what you learned?

Understanding a cybersecurity concept is useful only when it changes how you make decisions. When you encounter a similar situation in real life, slow down and identify what is being requested before you respond.

Ask yourself who is making the request, what they are asking you to do, what information or access is involved, and whether the request can be independently verified.

Do not allow urgency, fear, authority, familiarity or the promise of a reward to replace independent verification.

What if I still do not understand something?

Cybersecurity concepts can sometimes involve technical terms or situations that are difficult to interpret from a single lesson. If something is unclear, do not guess when the decision could affect your money, identity, account access, device or sensitive information.

You can seek further guidance through the consultancy channel. Explain the situation clearly, but never include passwords, OTPs, PINs, recovery phrases, private keys or other authentication secrets.

Use the consultancy form →

THE VERIFY BEFORE YOU TRUST PRINCIPLEVERIFY BEFORE YOU TRUST.

A convincing message, familiar name, professional appearance or urgent request is not proof of legitimacy. Verify the important facts independently before taking an action that could be difficult to reverse.