What is a payment link?¶

A payment link is a web address that takes a user to a page or application where a payment can be made.

Avoid the dangerous assumption¶

The dangerous assumption is that the visible link proves who created it, who will receive the money or which service will process the payment.

A merchant, payment provider, marketplace or individual may generate the link.

It may contain an order reference, payment request, recipient identifier, amount, currency or expiry information.

Some links open a hosted checkout page. Others redirect through several services before reaching the final payment provider.

The displayed text in a message may not match the actual destination address.

Relevant evidence may include the full URL, shortened-link destination, message containing the link, creation time, account that generated it, payment-request ID, recipient account and transaction records.

Preserve the link exactly as received before opening it where possible.

Record the message, sender account, date, time and surrounding instructions.

Do not rely only on a screenshot of the visible text. Preserve the underlying URL or message export.

Opening the link may create access logs, change its status or expose the investigator’s device and network details.

Where safe and authorised, use an appropriate controlled method or specialist support to examine it.

Ask the payment provider which account created the request, what details were embedded and whether any payment was completed.

A legitimate payment link can still be used in fraud if the victim was deceived about its purpose.

When reporting, distinguish the link, destination service, payment request, recipient account and completed transaction.

Operational takeaway¶

Preserve the complete payment link and message context, then use provider records to identify who created it, where it led and whether value was actually transferred.