How to Safely Pay Someone Online

Online payment scams often involve authorised push payment fraud, business email compromise, invoice redirection, payment redirection, marketplace fraud, fake payment portals, card phishing, investment scams, money mule recruitment, and account takeover.

The key issue is that many scams result in an authorised payment. The victim may personally approve the transfer, card payment, wallet transaction, or platform payment because they believe the request is legitimate.

Once a payment is authorised, recovery depends on the payment method, bank processes, platform rules, timing, jurisdiction, whether the recipient account can be frozen quickly, and whether the funds have already been moved through mule accounts or converted into another form.

Payment risk should be assessed across four questions:

• Identity: who am I paying?
• Destination: where is the money going?
• Purpose: why am I paying?
• Recoverability: what happens if I am wrong?

Bank transfers require special care.

In payment redirection and business email compromise scams, the attacker may compromise or impersonate a trusted party and provide altered bank details. This can happen during real transactions, including property purchases, supplier payments, construction work, school fees, rent, legal services, and business invoices.

The attacker does not always need to create a fake transaction. They may insert themselves into an existing transaction at the point where payment instructions are expected.

This is why an expected message can still be dangerous. The payment event may be real, but the destination account may be fraudulent.

High-risk payment scenarios include:

• First payment to a new recipient.
• New bank details for an existing recipient.
• Changed bank details sent by email or attachment.
• Large deposits, settlement payments, or milestone payments.
• Urgent payment instructions.
• Instructions to split payments across accounts.
• Requests to ignore previous bank details.
• Requests to move payment outside a normal platform.
• Requests to keep the payment confidential.

These should trigger out-of-band verification using a trusted contact method that was established before the payment request. Replying to the same email thread is not enough if the email account, mailbox rules, contact record, or conversation thread has been compromised.

Contact details inside the payment request should not be treated as proof. A fraudulent or altered message may include a fake phone number, fake email address, fake payment link, or fake portal designed to confirm the attacker’s own instructions.

Verification should confirm both identity and destination.

It is not enough to confirm that an invoice exists. The important question is whether the payment destination is correct. A strong verification process confirms the recipient, the account name, the BSB and account number or payment identifier, the amount, and the reason for payment using a trusted channel.

For very large payments, consider reading the account details back slowly, confirming them through more than one trusted method, and recording who confirmed the details and when.

Payment method changes are also a warning sign.

Attackers often prefer methods that are fast, final, hard to trace, or difficult to reverse. Examples include direct bank transfers, cryptocurrency, gift cards, wire transfers, instant transfer services, and payments made outside the normal marketplace or booking platform.

Card payments can still be fraudulent, especially when entered into fake websites or payment pages. However, card networks and trusted payment platforms may provide dispute or chargeback processes that are not available for every transfer type.

Fake payment portals can look legitimate.

A fake website may imitate a checkout page, investment dashboard, rental deposit page, parcel fee page, subscription renewal page, government payment page, or invoice payment page. It may collect card details, redirect to a bank transfer, or simulate a successful payment.

A fake payment flow should be assessed the same way as any other website: source of visit, actual domain, requested action, payment destination, and independent verification.

Sellers should also verify incoming payments.

Fraudsters may use fake receipts, altered screenshots, fake payment emails, overpayment stories, chargeback abuse, stolen accounts, or courier collection scams. A screenshot is not proof of cleared funds.

A safer seller process is to confirm funds inside the account or platform directly, avoid refunding overpayments to a different method, and avoid releasing goods before payment is confirmed.

Technical and process controls can reduce payment fraud risk:

• Use trusted platforms with buyer and seller protections where possible.
• Keep payments inside the normal marketplace, booking, or invoicing platform.
• Use saved payees or verified supplier records for repeat payments.
• Confirm first payments, new bank details, changed bank details, and large payments out-of-band.
• Use dual approval for large or business payments.
• Set transfer limits and alerts.
• Use account nicknames carefully and review payee details before confirming.
• Store verified payment instructions in a controlled system, not only in email.
• Monitor email accounts for forwarding rules, suspicious sessions, mailbox compromise, and unusual OAuth grants.
• Train staff and family members to treat bank detail changes as high-risk.
• Keep evidence such as invoices, messages, receipts, account details, confirmation records, and timestamps.

For businesses, invoice and supplier payment controls should assume that email can be compromised. The safer source of truth is a verified supplier record with controlled change processes, approval workflows, and independent confirmation for bank detail changes.

For individuals, the same principle applies in simpler form: do not rely on a single message when money is involved.

A useful model is to separate four things:

• Request: the message, invoice, website, call, or listing asking for payment.
• Recipient: the person, business, account, wallet, or platform receiving the money.
• Method: the payment type and how recoverable it is.
• Verification: the independent process used to confirm the payment is legitimate.

The safest payment is one where the recipient, destination, purpose, and method have all been checked before money is sent.