A message can look like a customer enquiry while attempting to obtain a payment, login code or access to the shop's account. Urgency, a familiar logo or a convincing screenshot does not establish that the request is legitimate.
Use a verification routine that does not depend on judging the sender's confidence. Protect authentication details and check money movement through the authorised account or provider, not through a link supplied by the person pressuring you.
Pause unusual requests
Be cautious when a supposed buyer asks you to pay a small fee, scan an unfamiliar code or install software before you can receive their payment.
Do not continue simply because the person claims to represent a large order or a well-known organisation. A valuable-looking enquiry can still be fraudulent.
Keep the conversation record while you verify through a separate official route.
Understand the direction of a UPI action
NPCI's fraud-awareness guidance warns that scanning a QR code and entering a UPI PIN is for making a payment, not receiving one.
Read the action and amount in the legitimate payment app before authorising anything. Do not follow a caller's instruction to ignore what the screen says.
Never share your UPI PIN or OTP. A customer does not need those details to pay the shop.
Verify receipts independently
Check the actual receiving account or authorised payment dashboard for the relevant transaction. A screenshot, forwarded message or edited receipt is not the source of truth.
Match the amount and reference to the order. If the payment remains uncertain, keep the order in the appropriate pending state rather than dispatching under pressure.
Do not accuse a customer merely because confirmation is delayed. Explain that the business must verify the transaction through its normal process.
Protect account access
Treat messages asking for login codes, password resets or new administrator access as separate security events, not ordinary sales support.
Open the service through your known app or saved official address rather than a link in the suspicious message. Check the request from there.
Do not grant access to someone claiming to fix an account problem unless their identity and authority have been verified through the proper channel.
Be careful with attachments and remote help
Do not install an unfamiliar app or allow screen control because a supposed customer says it is required for payment.
A file described as an order list can still be unsafe. Use the business's appropriate security process and avoid opening unexpected executable content.
If you need technical help, use a verified provider and a scoped support process. Do not expose unrelated credentials or customer records during the session.
Prepare a team stop rule
Tell helpers which requests must be escalated: authentication codes, payment to receive money, account access changes and unusual refund destinations.
Give them a verified contact route for the owner or responsible person. They should not have to decide alone while a sender creates urgency.
Do not punish a helper for pausing a suspicious request that later proves legitimate. The verification process exists to protect the business.
Act quickly after a suspected incident
Stop interacting through the suspicious route and contact the bank, payment provider or account service through its official channel. Use the relevant reporting process for your location and circumstances.
Preserve useful evidence without circulating sensitive details widely. If credentials or access may be compromised, follow the provider's account-recovery and security guidance promptly.
Do not promise that a payment can be recovered or rely on strangers offering guaranteed recovery services.
Improve the ordinary process
Keep payment confirmation, refunds and account administration documented so unusual requests stand out.
Use limited access and review unused connections. A customer-facing helper should not automatically hold every administrative permission.
The safest response is not an argument with a suspected scammer. It is a pause, an independent check and a controlled next step. That routine protects genuine customers too, because the business can explain consistently how payments and account requests are verified.
Examples are illustrative. Confirm current features, charges and suitability before making a business decision.
Explore this topic → · Find an oBizee setup guide · Ask about your store