Payment app scams: how they work and how to protect yourself

Payment apps like PayPal, Zelle, Venmo and Revolut are the fastest way to move money between people — and precisely for that reason they've become one of scammers' favourite hooks. The reason is simple: a payment you confirm in one of these apps leaves your account instantly and is very hard to get back. There's no waiting period, no cancel button, and often no intermediary holding the funds. That immediacy, so convenient between friends, is pure gold for anyone trying to trick you.

The good news: payment app scams repeat three very specific patterns. Once you know them, they're easy to sidestep.

Trap number one: they ask you for money disguised as a payment

This is by far the most widespread payment app scam, and it shows up above all in second-hand selling (eBay, Facebook Marketplace, Vinted, Craigslist, local buy-and-sell groups). It works like this:

You're selling something. A supposed buyer shows interest, closes the deal quickly and says they'll pay you through the app. A moment later a notification arrives... but it's not incoming money: it's a money request. The "buyer" isn't paying you; they're asking you to pay them. Apps like PayPal and Venmo let anyone send a payment request, and the notification looks deceptively similar to a payment. If you accept in a hurry, convinced you're collecting on your sale, the money leaves your account and lands in theirs.

How do I tell a payment from a request?

The difference is right there in the app, and it's worth burning into memory:

• When someone sends you money, you don't have to accept anything to receive it. The amount simply lands in your balance or account and you get an informational notice along the lines of "you've received X". There's no accept-or-decline button for genuinely incoming money.
• When someone requests money, the app asks you to confirm. You'll see a pending request with accept/decline buttons and, in most apps, wording that makes clear it's a request — along with the amount that would leave your account, often shown as a negative figure or with a minus sign.

The practical rule: if the app asks you to tap "accept" or "pay" in order to "get paid", you're not getting paid — you're paying. A real incoming payment never requires your confirmation. When in doubt, decline the request and check your transaction history: if the buyer really paid you, the money is already there.

Scammers know this and pile on the pressure: "accept it quick before it expires", "it's the app's new system for sales", "confirm and the payment comes through". All smoke. Urgency, as in every fraud, is the alarm bell.

A related marketplace trick to watch for: buyers who insist on paying via PayPal "Friends & Family" or a similar no-protection mode, or who "accidentally overpay" and ask you to refund the difference. Same family, same defence: slow down and check your actual balance.

The fake refund: "we owe you money, just accept the transfer"

The second variant arrives by phone call, text or email. Someone claiming to be from a government agency (the tax authority, social security, your local council), from your energy company or from your phone provider tells you you've been overcharged and they're going to refund you through your payment app. You just have to "accept the transaction" that's about to arrive.

What arrives, once again, is a money request, not a payment. If you accept it, the "refund" is actually a payment you're making.

One rule kills this scam at the root: government agencies don't issue refunds through P2P payment apps. Tax authorities refund by bank transfer to the account you registered with them, and no agency will ever call you to make you accept something on your phone against the clock. A legitimate company that owes you money credits it back to the account or card you paid with, with no race-against-time transactions. If something like this reaches you, treat it as fraud, full stop.

Payment apps + vishing: the "bank" call that walks you through it

The third variant is the most dangerous, because it combines the payment app with a phone call impersonating your bank. Someone calls claiming to be from your bank's fraud department: they've detected "suspicious transactions" and need your cooperation to "block them". From there, a professional-sounding voice guides you step by step: open the app, read out a code that just arrived by text, confirm a "test" transaction, accept a transfer "to reverse the charge".

Every step you take following their instructions is a real transaction that you yourself are authorising. The scammer hacks nothing: they persuade you to do it, with your own credentials and your own fingerprint.

The defence is the same as for any bank call: your bank will never ask you to authorise transactions, read out codes or send app payments during a call that you received. If you get a call with that kind of urgency, hang up and call the number on the back of your card yourself. We cover the full protocol in how to verify whether a call or text from your bank is real — and before anything else, you can look up the number that called you in the spam number directory to see if others have already reported it.

Quick signals: are they paying you or asking you to pay?

If in doubt, the definitive check takes ten seconds: close the notification, open your banking or payment app yourself, and look at your transaction history. Money you've genuinely received is already there; everything else is theatre.

What do I do if I've already accepted a fraudulent payment?

Act fast and in this order:

• Call your bank (or the payment app's support) immediately via the official number on the back of your card or inside the official app. Explain that you've been the victim of fraud and ask them to try to hold or reverse the transaction. The sooner you flag it, the more room there is — though with instant payments that room is small, which is exactly why speed matters.
• Keep all the evidence: screenshots of the conversation with the "buyer", the listing, the payment request, the number that called you, times and amounts.
• File a report with your local police or your country's cybercrime reporting service, attaching that evidence. The report is essential for any later claim against your bank or the platform.
• Escalate in writing to your bank's or the app's complaints service if they don't respond or reject your initial claim. We explain the available routes and how far they reach in how to get your money back after a phone scam.
• Report the phone number involved so the next person gets a warning. Every report in the NoCall directory makes the fraud a little less profitable.

Be honest with yourself about expectations: a payment you accepted is a transaction you authorised, and that complicates any refund. It's not impossible — especially where impersonation was involved and you act fast — but the best defence is still never to accept anything you don't fully understand.

In short

Payment apps are safe as systems; what fails is the context someone builds around them. Three rules cover almost everything: real incoming money never requires you to accept anything; no government agency refunds you through a P2P payment app; and your bank never walks you through authorising transactions over the phone. When in doubt, decline, hang up, and check your transaction history in the official app. You can see which fraud campaigns are most active right now on our trends page and pick up more defence techniques in our guides.

If a number has contacted you to slip you a payment request or while posing as your bank, report it in the NoCall spam number directory. Your warning may be what stops the next person from accepting that "payment" in a hurry.