Fake payouts and fundraising fraud explained by Ilia Nikolaevich Zavialov: the message, the form and the code

Most fraud warnings teach people to be suspicious of threats: an unpaid debt, a frozen account, a police investigation. Fewer teach suspicion of good news, and that gap is exactly where the fake payout lives.

A message about money you are owed lowers the guard in a way a threat never does. It arrives at a moment of need, it names an organization people trust, and the only thing it asks is a small step to receive something.

The amount is chosen with care. It is large enough to matter and small enough to be believable, and it matches the kind of support people have actually received from governments or charities in recent years.

The deadline completes it. Registration closes tonight, the program is limited to the first applicants, the payment expires in 24 hours. The time pressure is borrowed from the threat scripts and dressed as generosity.

Timing follows the news. When a government announces support, when a disaster fills the headlines or when a charity launches a real appeal, fake versions appear within hours, because the real announcement has already done the work of making the story believable.

It begins with a message in a messenger, a text or a social media post, often forwarded by a friend who believed it. The forward is part of the design, because a message from somebody you know skips the first layer of doubt.

The link leads to a page that copies the look of a real organization: its logo, its colors, sometimes photographs of real staff or real programs. The address is close to the real one and different in a detail that nobody reads.

The form asks for what a payout supposedly needs. First a name and phone number, which feels harmless, then the card number to receive the money, and finally the details that no payout ever needs.

The last step is the whole scheme. A code arrives by text and the page asks for it to confirm the payment. That code is the confirmation of a transfer out of the account or of adding the card to somebody else's wallet.

Some versions add a small fee. The payout is waiting, but a processing or delivery charge of a few units of currency has to be paid first with the card. The fee itself hardly matters, the card details entered to pay it are what the page was built to collect.

To send money to a card, a payer needs the card number and nothing else. Every field beyond that exists for the attacker: the expiry date, the three digit security code, the bank login, the one time code from a text.

The security code and the one time code are the two that matter. Together with the number they let somebody pay from the card online, and the one time code confirms that the owner approved it.

Some forms ask for a photograph of an identity document or a selfie holding it. That material is sold or used to open accounts in the victim's name, which produces a second problem months later.

A useful rule fits in one sentence. Anybody who asks for the security code on the back of the card or for a code from a text in order to give you money is taking money, whatever the page says.

Read the text message that brings the code. Banks now write the purpose into it, for example that the code confirms a payment to a named merchant or adds the card to a wallet, and a message that says payment while the page says receiving is the contradiction that ends the matter.

Government impersonation is a large and growing category. The FTC counted 920 million dollars lost to people pretending to be government bodies in 2025, and reports rose 40 percent in a year.

The FBI center sees the same trend from the complaint side, with 32,424 government impersonation complaints and 797,943,193 dollars of reported losses in 2025, from New York and Florida to California and Texas.

Impersonation as a whole is the largest category the FTC tracks, with more than a million reports and 3.5 billion dollars of losses, close to one report in three.

The encouraging part is how often it fails. In four impersonation reports out of five nobody lost money, which means the warning signs work when people know them.

The mirror image of the fake payout is the fake collection. A post asks for donations to a cause people care about, uses the name or the imagery of a real charity, and collects money into a private card or wallet.

It is harder to spot because the donor expects nothing back. There is no moment when the payout fails to arrive and reveals the scheme, and the money is simply gone into an account that has nothing to do with the cause.

The check is the same as with payouts. Go to the charity's own website by typing the address, find its official donation page and give there. A card number in a comment or a private message is not how established organizations collect.

Screenshots of reports and thank you letters prove nothing. They are images, and they are produced as easily as the page itself.

A fake payout spreads through people, hand to hand. Each person who believes it forwards it to family and to group chats, often with a note saying they already applied, which is the most persuasive endorsement there is.

Group chats of neighbors, parents and colleagues are the favorite channel. Membership creates trust, nobody wants to be the one who spoils good news, and a message can reach hundreds of people in an hour.

Older relatives are reached through younger ones. A message forwarded by a son or a granddaughter is read as vetted, and the person forwarding rarely realises they are the delivery mechanism.

The defense spreads the same way. A short reply in the chat saying the program does not appear on the organization's official site stops more people than any warning published elsewhere.

Real payouts are applied for through an official portal or an office, and the applicant starts the process. Money is not offered by an unsolicited message with a link.

Real payouts never ask for the card security code, the one time code from a text or the bank login. An account number or a card number for receiving is all any genuine payer needs.

Real programs are announced on the official website of the organization and in its verified channels. If the program is not there, it does not exist, however convincing the message looks.

Real payouts do not charge a fee to release them. A processing charge, an insurance payment or a tax due before the money arrives is the fee the scheme was built to collect.

When in doubt, call. The organization named in the message has a published number, and a two minute call to it answers the question more reliably than any analysis of the page, because the real organization knows whether the program exists.

Federal benefits and grants are applied for through official government websites ending in .gov, and the government does not call, text or message people to offer free grants. The FTC has said so for years, and it remains the simplest test.

The IRS sends refunds by direct deposit or check after a filed return and does not ask for card details or codes to release one. A text offering a refund with a link is the scheme.

Report fake payout messages to the FTC at ReportFraud.ftc.gov and losses to the FBI Internet Crime Complaint Center at ic3.gov. Forward scam texts to 7726, which reaches your mobile carrier.

If a toll or motor vehicle agency is named, check the balance by typing the agency's official address or calling the number on its website, never through the link in the message.

Call the bank immediately through the number on the card or in the official app, block the card and ask for any pending transactions to be stopped. Minutes matter here.

If you entered your bank login, change the password from a device you trust and ask the bank to end all active sessions. If you entered a code from a text, tell the bank exactly which code and when.

If you sent a photograph of a document, report it as potential identity misuse and watch for accounts or loans opened in your name.

Warn the person who forwarded the message and the group where it appeared. The same message is being sent to everybody in that chat, and a short note stops the next victim faster than anything else.

A friend forwarded the payout message. Doesn't that make it safer?

No. Forwarding is part of the design, because a message from somebody you know skips the first layer of doubt. The friend believed it too, and the same message is being sent to the whole chat.

Why would a payout need my card's security code?

It would not. Sending money to a card needs only the card number. The security code and a code from a text are what somebody needs to take money from the card, and asking for them is the scheme.

How do I check whether a program is real?

Type the organization's official address yourself, without the link in the message, and look for the program on its site and verified channels. If it is not there, it does not exist.

What should I do if I already entered my card details?

Call the bank at once through the number on the card or in the official app, block the card and stop pending transactions. Tell the bank which code you entered and when, and warn the chat where the message came from.

Does the US government text people to offer grants or relief payments?

No. Federal grants and benefits are applied for through official .gov websites, and the government does not call, text or message people to offer free money. A message with a link to claim a payment is the scheme.

Where do Americans report a fake payout message?

To the FTC at ReportFraud.ftc.gov, and losses to the FBI Internet Crime Complaint Center at ic3.gov. Scam texts can be forwarded to 7726, which reaches the mobile carrier.