What questions should I ask when someone reports a suspicious payment?¶

When someone reports a suspicious payment, the first account is often incomplete, emotional and focused on the loss rather than the evidence.

Avoid this assumption: Asking only who was paid, how much and when will give you enough to investigate.

Start by establishing exactly what happened. Ask what type of payment was involved, which account, card, wallet or service was used, and whether the payment is pending, completed, reversed, refunded or disputed.

Ask how the person first became aware of it. Did they see it in an application, statement, email, text message, merchant receipt or provider alert? Preserve that original source.

Then establish what the person did before the payment. Did they click a link, scan a QR code, install software, speak to someone, disclose a code, add a beneficiary, approve a login or move money after receiving instructions?

Ask whether they personally authorised the payment. If they did, establish what they believed they were authorising and why. Authorised payment does not necessarily mean informed consent.

Identify all relevant communications. Preserve phone numbers, usernames, email addresses, websites, messages, call times, reference numbers and any instructions given.

Ask which devices and accounts were used, whether anyone else had access, whether the device behaved unusually and whether remote-access software was installed.

Record the complete transaction details: amount, currency, dates, times, status, account or card details as displayed, beneficiary or merchant, payment reference and transaction identifier.

Ask what happened after the payment. Were further payments attempted? Was money moved again? Did the bank contact them? Were credentials changed? Was the account frozen or recovered?

Finally, identify immediate risk. Other accounts, cards, devices or victims may still be exposed. Preservation and protective action may need to happen in parallel.

Keep the account factual. Separate what the person saw, what they were told, what they did and what the provider later confirmed.

Operational takeaway¶

Obtain the complete payment story, preserve every identifier and communication, and separate authorisation from informed consent and personal control.