Receiving an email asking you to make a payment, verify your card information, or confirm a financial transaction has become a common occurrence. The problem is that not all of these messages come from the sender they claim to be. Payment scam emails are one of the most widespread forms of digital fraud in Italy and Europe, and they affect both individuals and professionals alike, regardless of their level of tech savvy. Knowing what not to do when you receive one of these messages is the first and most effective line of defense.

What a payment scam email looks like

The common thread in almost all variations of this scam is the impersonation of a trustworthy sender. It could be your bank, your credit card issuer, a digital payment service, a shipping company asking you to pay a small fee to release a package, or even a government agency notifying you of a pending refund. In some cases, the message is so well crafted—with proper graphics, a formal tone, and the recipient’s name included—that distinguishing it from a genuine communication requires careful attention.

What all these variations have in common is the goal: to get you to click on a link, enter your card information or account credentials, or make a transfer to an account that has nothing to do with the alleged sender.

Do not click on any links in the message

This is the most frequently repeated piece of advice and, unfortunately, still the one most often ignored. The links in emails of this type almost always lead to fake pages, designed to look as much like the official websites of the services they’re impersonating as possible. The page might ask you to enter your card information—number, expiration date, CVV code—or your account login credentials. In either case, everything you type ends up directly in the hands of the scammers.

The address you see in the body of the message isn’t necessarily the one the link actually takes you to: all it takes is a second of distraction to miss it. If you need to verify a message regarding a payment or a service you use, open your browser and go directly to the official website by typing the address yourself. Never follow the link provided in the email.

Never enter your card information on pages accessed via email

Even if you’ve already clicked the link, as long as you haven’t entered any sensitive information, the damage can still be avoided. The point of no return is when you fill out a form with your card number, expiration date, security code, or any combination of these details. No legitimate service requests your full card details via a link sent by email: this practice is incompatible with the security standards that all regulated financial institutions are required to comply with under the European Payment Services Directive, known as PSD2.

If a page you access via email asks for this information, you’re looking at a fraudulent site, no matter how authentic it may seem.

Don’t let the urgency of the message sway you

Scam emails related to payments almost always include an element of time pressure. “The payment must be confirmed by the end of today,” “your card will be blocked within the next few hours,” “you have 48 hours to claim your refund.” This tactic serves a specific purpose: to limit the time you have to think it over, verify the information, or ask someone for help.

Legitimate services—banks, card issuers, payment platforms—do not communicate this way. Urgent and legitimate communications go through secure channels, in-app notifications, or direct contact. Whenever an email pressures you to act quickly on something involving money or financial information, that’s exactly when you should slow down.

Do not reply to the sender and do not use the contact information provided in the email

Some variations of this scam require you to reply to the message or call a phone number listed in the body of the text. In either case, you’re interacting with scammers. The numbers listed in these emails connect you to operators who pretend to be customer service representatives of the service they’re impersonating, with the goal of obtaining sensitive information during the call or convincing you to perform a transaction.

If you need to verify a communication, use only the official contact information found on the service’s website or in the physical documentation provided to you at the time of sign-up. Never use the contact information that appears in an email you’re not sure about.

Be wary of payment requests via direct links

A particular type of scam involves emails that do not ask you to enter any information but instead ask you to click a “Pay Now” or “Complete Payment” button. This often occurs with fake shipping notifications requesting payment of customs duties or additional fees, or with fake invoices from service providers. In these cases, payment is made directly through the fraudulent page, and the money cannot be recovered except through a formal dispute with your bank—and even then, the outcome is far from guaranteed.

Before making any payment requested via email, always verify that the request is legitimate by visiting the alleged sender’s website yourself or by contacting the service directly.

If you’ve already taken action: what to do right away

If you’ve clicked a link, entered personal information, or made a payment, it’s important to act without delay. Immediately contact your bank or card issuer to block any pending transactions or report an unauthorized transaction. Change your login credentials for the affected services. File a report with law enforcement; this is also a necessary step to initiate any refund procedures. According to the Bank of Italy’s regulations, the timeliness of the report significantly affects the chances of recovery and the assessment of liability in unauthorized payment transactions.

A.E.C.I. regularly assists consumers who find themselves in this situation, often after they discover what has happened only days later. The sooner you take action, the greater the chances of limiting the damage.

Have you received a suspicious email or been the victim of a payment-related scam? Contact A.E.C.I. at 064510914 or file a report through our online consumer help desk: consumer help desk