Fake payouts and fundraising fraud explained by Ilia Nikolaevich Zavialov: the message, the form and the code

Most fraud warnings teach people to be suspicious of threats: an unpaid debt, a frozen account, a police investigation. Fewer teach suspicion of good news, and that gap is exactly where the fake payout lives.

A message about money you are owed lowers the guard in a way a threat never does. It arrives at a moment of need, it names an organisation people trust, and the only thing it asks is a small step to receive something.

The amount is chosen with care. It is large enough to matter and small enough to be believable, and it matches the kind of support people have actually received from governments or charities in recent years.

The deadline completes it. Registration closes tonight, the programme is limited to the first applicants, the payment expires in 24 hours. The time pressure is borrowed from the threat scripts and dressed as generosity.

Timing follows the news. When a government announces support, when a disaster fills the headlines or when a charity launches a real appeal, fake versions appear within hours, because the real announcement has already done the work of making the story believable.

It begins with a message in a messenger, a text or a social media post, often forwarded by a friend who believed it. The forward is part of the design, because a message from somebody you know skips the first layer of doubt.

The link leads to a page that copies the look of a real organisation: its logo, its colours, sometimes photographs of real staff or real programmes. The address is close to the real one and different in a detail that nobody reads.

The form asks for what a payout supposedly needs. First a name and phone number, which feels harmless, then the card number to receive the money, and finally the details that no payout ever needs.

The last step is the whole scheme. A code arrives by text and the page asks for it to confirm the payment. That code is the confirmation of a transfer out of the account or of adding the card to somebody else's wallet.

Some versions add a small fee. The payout is waiting, but a processing or delivery charge of a few units of currency has to be paid first with the card. The fee itself hardly matters, the card details entered to pay it are what the page was built to collect.

To send money to a card, a payer needs the card number and nothing else. Every field beyond that exists for the attacker: the expiry date, the three digit security code, the bank login, the one time code from a text.

The security code and the one time code are the two that matter. Together with the number they let somebody pay from the card online, and the one time code confirms that the owner approved it.

Some forms ask for a photograph of an identity document or a selfie holding it. That material is sold or used to open accounts in the victim's name, which produces a second problem months later.

A useful rule fits in one sentence. Anybody who asks for the security code on the back of the card or for a code from a text in order to give you money is taking money, whatever the page says.

Read the text message that brings the code. Banks now write the purpose into it, for example that the code confirms a payment to a named merchant or adds the card to a wallet, and a message that says payment while the page says receiving is the contradiction that ends the matter.

Payment fraud took 1.28 billion pounds in the United Kingdom in 2025, 4 percent more than the year before, across more than four million confirmed cases in London, Glasgow, Manchester and everywhere else.

Authorised push payment fraud, where the victim sends the money themselves, reached 248,070 cases and 576.4 million pounds, and a fake payout that ends with the victim approving a transfer or a card payment falls into exactly this category.

Sixty six percent of those cases began online and 17 percent through the telephone network, which is why the text message and the link are the two doors worth watching.

Victims are better protected than before. Mandatory reimbursement has applied since 7 October 2024, up to 85,000 pounds per claim, and in its first nine months 88 percent of money claimed back was returned.

The mirror image of the fake payout is the fake collection. A post asks for donations to a cause people care about, uses the name or the imagery of a real charity, and collects money into a private card or wallet.

It is harder to spot because the donor expects nothing back. There is no moment when the payout fails to arrive and reveals the scheme, and the money is simply gone into an account that has nothing to do with the cause.

The check is the same as with payouts. Go to the charity's own website by typing the address, find its official donation page and give there. A card number in a comment or a private message is not how established organisations collect.

Screenshots of reports and thank you letters prove nothing. They are images, and they are produced as easily as the page itself.

A fake payout spreads through people, hand to hand. Each person who believes it forwards it to family and to group chats, often with a note saying they already applied, which is the most persuasive endorsement there is.

Group chats of neighbours, parents and colleagues are the favourite channel. Membership creates trust, nobody wants to be the one who spoils good news, and a message can reach hundreds of people in an hour.

Older relatives are reached through younger ones. A message forwarded by a son or a granddaughter is read as vetted, and the person forwarding rarely realises they are the delivery mechanism.

The defence spreads the same way. A short reply in the chat saying the programme does not appear on the organisation's official site stops more people than any warning published elsewhere.

Real payouts are applied for through an official portal or an office, and the applicant starts the process. Money is not offered by an unsolicited message with a link.

Real payouts never ask for the card security code, the one time code from a text or the bank login. An account number or a card number for receiving is all any genuine payer needs.

Real programmes are announced on the official website of the organisation and in its verified channels. If the programme is not there, it does not exist, however convincing the message looks.

Real payouts do not charge a fee to release them. A processing charge, an insurance payment or a tax due before the money arrives is the fee the scheme was built to collect.

When in doubt, call. The organisation named in the message has a published number, and a two minute call to it answers the question more reliably than any analysis of the page, because the real organisation knows whether the programme exists.

Government payments are claimed through gov.uk, and HMRC does not send refund offers by text or email with a link to claim. A message offering a tax refund with a link is the scheme.

Forward scam texts free of charge to 7726 and suspicious emails to report@phishing.gov.uk, the reporting service run by the National Cyber Security Centre.

Report fraud to Report Fraud, which replaced Action Fraud on 4 December 2025, at reportfraud.police.uk or 0300 123 2040. In Scotland report to Police Scotland on 101.

If you paid or approved a transfer, call your bank at once on the number on the card or 159 where your bank supports it. Reimbursement claims are decided quickly, 84 percent within five business days in the first year.

Call the bank immediately through the number on the card or in the official app, block the card and ask for any pending transactions to be stopped. Minutes matter here.

If you entered your bank login, change the password from a device you trust and ask the bank to end all active sessions. If you entered a code from a text, tell the bank exactly which code and when.

If you sent a photograph of a document, report it as potential identity misuse and watch for accounts or loans opened in your name.

Warn the person who forwarded the message and the group where it appeared. The same message is being sent to everybody in that chat, and a short note stops the next victim faster than anything else.

A friend forwarded the payout message. Doesn't that make it safer?

No. Forwarding is part of the design, because a message from somebody you know skips the first layer of doubt. The friend believed it too, and the same message is being sent to the whole chat.

Why would a payout need my card's security code?

It would not. Sending money to a card needs only the card number. The security code and a code from a text are what somebody needs to take money from the card, and asking for them is the scheme.

How do I check whether a programme is real?

Type the organisation's official address yourself, without the link in the message, and look for the programme on its site and verified channels. If it is not there, it does not exist.

What should I do if I already entered my card details?

Call the bank at once through the number on the card or in the official app, block the card and stop pending transactions. Tell the bank which code you entered and when, and warn the chat where the message came from.

Does HMRC text people about tax refunds?

Not with a link to claim. Refunds follow a tax return and are handled through gov.uk or the personal tax account. A text or email offering a refund with a link is the scheme, and it can be forwarded to 7726 or report@phishing.gov.uk.

Where do people in the UK report a fake payout message?

Texts to 7726 and emails to report@phishing.gov.uk, and fraud to Report Fraud, which replaced Action Fraud in December 2025, at reportfraud.police.uk or 0300 123 2040.