What questions should I ask when someone reports a suspicious payment?¶

Establish the complete payment story: what event occurred, how the person encountered and authorised it, which devices and communications were involved, and what changed afterward.

Reconstruct action and belief¶

Identify the payment type, account or instrument, amount, currency, status, times, beneficiary and transaction references. Ask where it was first seen and preserve that source.

Then establish preceding actions: links, QR codes, calls, installed software, disclosed codes, new beneficiaries or login approvals. If the person authorised payment, record what they believed they were approving; authorisation is not necessarily informed consent.

Map evidence and continuing risk¶

Preserve messages, emails, numbers, usernames, websites and instructions, plus devices, shared access and remote-control indicators. Record later provider contact, further attempts, credential changes and onward movement. Separate what the reporter saw, was told and did from what a provider later confirmed.