Recognise fake support, substituted payment codes and message-based phishing. The goal is to stop an unsafe action early, preserve useful evidence and contact the real account provider.
Separate the message from the institution
CamCERT publishes awareness material on SMS and Telegram phishing. A message can imitate a bank, broadcaster, courier or sports club while directing you elsewhere. Check the action requested: a demand for an OTP, a new app, remote control or an urgent transfer deserves scrutiny even when the logo looks familiar. Open the institution’s known app or type its verified website independently. Do not use the number supplied by the suspicious sender to authenticate that same sender. An encrypted connection to a fake site still leads to a fake site.The QR code is only an instruction
A printed code can be covered with another code, and an image in a chat can belong to someone else. The ABA QR instructions stress checking the amount and currency in the app. Add a recipient-name check against the merchant or invoice before approving. If staff say an unfamiliar personal name is normal, ask for clarification through the business’s verified contact. A code that opens a browser page asking for a banking password is different from a payment instruction inside your own bank app. Stop when the flow changes unexpectedly.
Warning signs and safer responses
| Warning sign | Safer response | Do not provide |
|---|---|---|
| Urgent account-lock message | Open your bank app independently | OTP or password |
| Stream requires a file download | Use the broadcaster’s verified app route | Accessibility or remote-control permission |
| Unexpected payment recipient | Confirm with the merchant before sending | A transfer made just to test trust |
| Recovery agent asks an advance fee | Contact the original provider directly | Another payment or account credentials |
| Caller asks to share your screen | End the session and verify the contact | Visible balances or authentication codes |
If you already interacted
Describe what happened precisely. Merely receiving a message, opening a page, entering credentials, installing software and approving a transfer are different exposure levels. If you entered a password, change it from a trusted device and review active sessions. If you installed suspicious software or enabled remote access, stop using that device for payments and seek qualified assistance. Contact the bank or wallet through its official route to request protective action appropriate to the account. Preserve the reference and timestamps of unauthorised transfers; do not delay contact while attempting to identify the attacker yourself.
Evidence and reporting checklist
- Record the suspicious URL or account handle without continuing the interaction.
- Keep message times and relevant screenshots, excluding secret codes.
- Tell the provider whether credentials, device access or money were involved.
- Review account sessions and linked devices from a trusted device.
- Keep the provider case reference and follow its verified instructions.
- Use an appropriate official incident or consumer route for the remaining problem.
CamCERT’s published role includes security information and incident coordination. That role should not be confused with a merchant-refund decision. For a separate consumer dispute, the CCF complaint route requests a factual account of the transaction.
Make recovery harder to impersonate
Keep official support links in a private bookmark before an incident. Use unique passwords and the strongest authentication the service supports, maintain device updates and review permissions after installing apps. Agree with family members on an independent way to verify urgent money requests. Do not announce full account numbers, identity documents or loss details in public groups: someone may use them to impersonate support. Recovery is not guaranteed, but an accurate early report helps the provider assess protective steps. No legitimate educational page needs access to your bank login to explain this process.
Example: a fake match-refund message
A message claims that a cancelled sports event entitles you to a refund, but asks you to scan a QR and approve a transfer. Stop and inspect what the bank app says the action will do. Sending money is not the same as receiving a refund. Independently check the organiser’s cancellation notice and contact the original seller using the receipt. If you already approved an outgoing transfer, report that fact accurately to your financial provider; do not describe it as a normal incoming refund. Preserve the suspicious message and payment reference privately. The apparent connection to a real event does not authenticate the sender, because event information is often public.
Frequently asked questions
Does a bank logo make a QR safe?
No. Inspect the recipient, amount and currency in your own app and confirm unexplained differences before authorising.
Should I send my OTP to support?
No. Do not disclose authentication codes to a caller, chat account or supposed recovery agent.
Can CamCERT automatically refund a transfer?
No. Incident coordination and payment recovery are different functions. Contact the financial provider promptly about the transaction.
Sources and verification
- CamCERT security awareness — CamCERT — 2026-10-23
- What CamCERT does — CamCERT — 2026-10-23
- ABA QR dual-currency code — ABA Bank — 2026-10-23
- Consumer complaint submission — CCF / Ministry of Commerce — 2026-10-23