Payment Link Fraud in India: How Merchants Protect Customers from Fake Payment Links and Pages
Payment links have become a normal way for Indian businesses to collect money. A caterer sends one on WhatsApp after confirming a menu, a clinic sends one by SMS before an appointment, and a B2B supplier puts one on an invoice. The same convenience makes them easy to imitate. A fraudster who knows that a business collects money through links only has to send a convincing one first.
When that happens, the customer loses money, the business loses the sale and often the customer’s trust, and the support team spends days on complaints about a payment it never received. This guide explains how payment link fraud works in India, the controls merchants can set on their own links and channels, and what to do when a fake link or page appears.
Quick answer: Payment link fraud happens when criminals send customers links or pages that imitate a real business, so the money goes to the criminal’s account. Merchants cannot stop every fake message, but they can make genuine links easy to recognise. Send links only from registered SMS headers, a verified WhatsApp Business number and an authenticated email domain. Use one consistent domain, lock the amount, set a short expiry, attach a reference ID, and fulfil only after a verified webhook confirms payment. Publish a page explaining how you contact customers, and report fake links to the gateway, 1930 and cybercrime.gov.in quickly.
How does payment link fraud work in India?
Payment link fraud is impersonation. The criminal does not need to breach the merchant’s systems, only to convince the customer that a link came from the business. RBI’s BE(A)WARE booklet on fraud methods describes the core pattern: fraudsters copy genuine websites and send masked links through SMS, email, social media and messaging apps.
The variations merchants see most often are:
- Cloned brand pages. A copy of the merchant’s order or checkout page, with the same logo and photos, on another domain. The pay button leads to the fraudster’s own gateway account or UPI ID.
- Lookalike domains. Names that differ by one character, add a word such as “pay” or “support”, or swap the extension. On a phone, where the address bar shows only part of the URL, these are hard to spot.
- Fake links on WhatsApp and SMS. Messages saying an order is on hold or a delivery fee is due. Moneylife has reported cases where the name and logo on a payment page were set to look like a known entity while the money went to the fraudster.
- Fake support teams. Criminals plant fake customer care numbers in search results and social media comments, a method RBI’s booklet lists separately. The “agent” then sends a link for a refund processing fee.
- Overpayment and refund tricks. The customer is told they paid twice and must pay a link to “release” a refund, or the business is told a customer overpaid and asked to return the difference to a new account. In October 2026, SBI warned customers about a version that starts with a small unexpected credit. Our guide toUPI fraud prevention for merchantscovers the shop-counter versions.
- SMS forwarding apps. The fake agent asks the customer to install an app, often an APK file sent on WhatsApp, to “track the refund”. The app forwards incoming SMS, including OTPs, to the fraudster. A UCO Bank advisory from May 2024 and a PIB Fact Check warning in June 2026 both describe APK files on WhatsApp as a route to taking over a phone. Once SMS is forwarded, OTPs fail much as they do in aSIM swap attack.
Each of these depends on one gap: the customer cannot reliably tell a genuine link from a fake one. QR-based versions of the same trick are covered in our article onQR code payment scams.
Why should merchants treat fake links as their problem?
The merchant’s systems are usually never touched, yet the cost lands on the business. Customers blame the brand they thought they were paying, complaints reach your support desk, and some customers dispute genuine orders because they believe they already paid. Fraudsters also return to brands that work for them, so an unanswered first campaign often brings a second.
Which channels should a merchant use to send payment links?
The aim is a short, fixed list of channels that customers can learn and check. Staff should never send links from anywhere else.
- SMS. Send only through your DLT-registered header and approved templates. Under a TRAI direction, links in commercial SMS have had to be whitelisted since 1 October 2024, and messages with links that are not whitelisted are not delivered, so whitelist the exact domain your links use. Operators now add a suffix to commercial headers (-T transactional, -S service, -P promotional, -G government), so a payment link should come from a header ending in -S or -T, never a 10-digit mobile number.
- WhatsApp. Use the WhatsApp Business Platform with a verified business portfolio. Eligible businesses can apply for Official Business Account status, which shows a blue checkmark beside the name. Never let staff send links from personal numbers.
- Email. Send from your own domain with SPF, DKIM and DMARC at an enforcement policy (quarantine or reject), so spoofed mail is more likely to be blocked.
- Invoices. Print the link domain and invoice reference next to the link so the customer can match them.
What payment link settings reduce fraud?
Most payment gateways in India offer similar link controls under different names.Razorpay’s Payment Links documentation, for example, shows fields for expiry, partial payments, a minimum first partial amount and a reference ID that must be unique for each link. Treat the values below as a starting point.
| Setting | Recommended value | Why it helps |
|---|---|---|
| Amount | Fixed by the merchant, not editable by the customer | Customers cannot be talked into entering a different figure |
| Expiry | Hours to a few days for retail orders; up to the due date for B2B invoices | Old links in chat history cannot be reused or re-sent |
| Partial payments | Off by default; on only for agreed instalments, with a minimum first amount | Blocks “pay a small token now” tricks |
| Reference ID | Unique order or invoice number on every link, shown on the page | Customers and support can match the link to a real order |
| Customer details | Pre-filled; link sent only to the contact on file | Reduces links reaching the wrong person |
| Description | Specific: order number, items, date | Generic text is easy to copy |
| Webhook | Enabled, with signature verification | Gives a trusted signal for fulfilment |
| Unused links | Cancelled when an order changes or closes | Prevents duplicate payments and confusion |
How do branded domains and reference IDs help customers verify a link?
A customer can only check a link against something they already know. Use one domain for everything customer-facing: your main domain, a subdomain such as pay.yourbrand.in, or your gateway’s standard link domain, used consistently. Avoid public URL shorteners, which hide the destination.
RBI applied the same idea to banks. Its circular of 22 April 2025 required banks to move to the .bank.in domain by 31 October 2025 so customers could recognise genuine bank sites. Merchants cannot use that domain, but the principle carries over: one recognisable domain, stated publicly, is easier to check than many.
Put the order or invoice number in the message, on the payment page and on the receipt, and tell customers to match them. It also helps to watch for new domains and social media pages using your brand name.
Why must fulfilment wait for webhook confirmation?
Link fraud also targets merchants directly, with a screenshot of a “paid” link, an edited SMS or a forwarded receipt. Four rules close this route:
- Fulfil only after your server receives the gateway’s webhook and verifies its signature, amount, currency and reference ID against the order.
- If the webhook is delayed, query the gateway’s API for status. Do not rely on anything the customer sends.
- Never treat screenshots, forwarded SMS or bank statement images as proof of payment.
- Process webhooks idempotently so a repeated event does not ship an order twice. Our guide topayment API and webhook securitycovers signature checks and replay protection.
Protect the account that creates links too. A compromised staff login can create real links or edit settlement details, so use multi-factor authentication and role-based access, as described in our article onpayment gateway dashboard security.
What should a “how we will contact you” page say?
Publish a short page showing how genuine payment requests look, and link it from your website footer, order confirmations, invoices and WhatsApp Business profile. It should list:
- Your SMS headers, official WhatsApp number and display name, and email domain.
- The domain your payment links use and the registered business name shown on the page.
- That you will never ask customers to install an app, share an OTP or UPI PIN, share their screen, or pay a fee to receive a refund.
- That refunds always go back to the original payment method.
- Your support numbers, and how to report a suspicious link to you.
What red flags can customers check before paying?
Adapt this table for your contact page or order emails.
| Red flag | What the customer should do |
|---|---|
| Link sent from an unknown mobile number or personal WhatsApp | Compare with the official channels on the merchant’s website |
| Domain differs from the usual one or has extra words or misspellings | Type the merchant’s website address directly |
| Amount differs from the quote, or the page asks you to enter it | Confirm the amount with the merchant first |
| No order number, or one you do not recognise | Check your order confirmation |
| Pressure such as “pay in 30 minutes or the order is cancelled” | Contact the merchant through its listed support number |
| Asked to pay or enter a UPI PIN to receive a refund | Stop; receiving money never needs a PIN |
| Asked to install an app, open an APK file or share your screen | Decline and report the message |
| Payee name in the UPI app differs from the business name | Do not approve the payment |
What should you do when a fake payment link or page is found?
Speed matters most when customers have already paid. A practical sequence:
- Capture evidence: the message, full URL, sender number or header, the page, payee name and any UPI ID or account details, with timestamps. Do not make test payments.
- Report to your gateway, and to the gateway or payment aggregator hosting the fake page if you can identify it, so it can review and block the account.
- Help customers who lost money call 1930 or file at cybercrime.gov.in quickly. Fast reports let banks try to hold funds; in December 2024 the government said over Rs 3,431 crore had been saved across more than 9.94 lakh complaints. The portal also has a “Report and Check Suspect” section.
- Report the message on Sanchar Saathi’s Chakshu facility, which accepts reports of malicious links, websites and fake customer care helplines.
- Request takedowns from the domain registrar and host, report the number on WhatsApp, and use social media impersonation forms. CERT-In’s April 2022 directions list spoofing, phishing and fake mobile apps among incidents reportable within six hours, so check with your legal team whether a campaign impersonating you must be reported.
- Warn customers on the channels they trust. Describe the fake link precisely, repeat your official domain and give victims a clear support route.
- Record the incident and update yourpayment fraud response plan.
Frequently asked questions
1. What is payment link fraud?
It is a scam in which criminals send links or pages that imitate a genuine business, so customers pay the criminal instead. The links usually arrive on WhatsApp, SMS, email or social media.
2. Is the merchant liable if a customer pays a fake link?
The money goes to an account the merchant does not control, so it is not a transaction with the merchant. The merchant still carries the support burden and loss of trust, which is why prevention and quick warnings matter.
3. How can customers tell a genuine payment link from a fake one?
They should check that it came through a channel listed on the merchant’s website and that the domain, amount, order number and payee name are correct. Anything that asks for an app install or a PIN to receive money is fake.
4. Should merchants use URL shorteners for payment links?
No. Public shorteners hide the destination. Use your own domain or your gateway’s standard link domain consistently.
5. Can a screenshot of a paid link be trusted?
No. Screenshots are easy to fake. Fulfil orders only after a verified webhook or an API status check confirms payment.
6. Where should a fake payment link be reported in India?
Report it to your gateway, to cybercrime.gov.in or 1930 if money was lost, to Sanchar Saathi’s Chakshu facility for the message, and to the registrar, host and platform for takedown.
7. Do TRAI’s SMS rules stop fake links?
They help with commercial SMS, since links must be whitelisted and header suffixes show the message type. Fraud sent from ordinary mobile numbers or on WhatsApp is not covered, so customer awareness still matters.