Skip to content
FIN-CSIRT
RS

FIN-CSIRT / Search

What are you looking for?

Start typing to see results.
    Report an incident

    FIN-CSIRT / Practical lesson

    Check a financial offer before paying

    Separate a convincing story from details you can verify independently.

    Users of financial servicesAbout 5 minutes of reading + 3 questions
    Start with the example Need to act now?

    What you will learn

    • Check who is behind an offer.
    • Recognise pressure and an unclear payment request.
    • Choose the first step if you have sent money.

    Practice example

    Does a friend’s recommendation settle the checks?

    A message from a familiar profile
    Today, 09:41

    A friend sends an investment offer. They say there is one place left and payment is needed today. The message gives a new recipient account.

    Fictional training example.
    Show the example explanation
    A familiar profile
    The account may have been taken over. Confirm the recommendation using contact details you already know.
    A payment deadline
    A short deadline reduces checking time; it does not establish the quality of the offer.
    A new recipient
    Establish who you would be paying and what for before sending money.

    Three checks before a decision

    Financial fraud may begin with an investment offer, a recommendation on social media or a message resembling routine business communication. The aim is to get you to send money or information before checking the request.

    A decision needs answers to three questions: who is contacting you, what exactly they want and why they say there is no time to check.

    Who is behind the offer?

    A name, logo or familiar profile does not confirm identity. Find the organisation’s contact details independently of the message. If a friend contacts you, check with them through a channel you have used before. Their account may have been taken over.

    What must you send, and to whom?

    Before paying, identify the recipient, purpose and terms. If you cannot explain where the money goes and what you receive in return, you need more information. Do not enter card or account details into a form whose origin you have not verified.

    A person checking a financial offer on a mobile phone

    Why is the decision urgent?

    Pressure to pay immediately or keep the offer secret is a reason to pause. A deadline alone is not proof of fraud; assess it alongside the sender’s identity and request. Impersonation and pressure are common scam patterns.

    Talking to someone you trust can help you consider an offer. It does not replace checking its terms. Being deceived does not mean someone failed to take care: scams exploit trust and familiar routines.

    If you have already sent money or information

    1. Contact your bank or payment service immediately and explain your concern. Ask what action is possible; reimbursement is not guaranteed.
    2. Keep messages, the page address and proof of payment. Do not make further payments to supposedly release the money.
    3. If you exposed a password, follow the account recovery guide.
    4. Report the content to the platform and, where it concerns a cyber incident, FIN-CSIRT. This does not replace urgent contact with your bank.

    Do not accept an unexpected offer to recover the money for a new fee. This is a pattern seen in refund and recovery scams.

    Check your knowledge · 3

    Your turn to choose the next step.

    Choose one answer for each question shown. More complex lessons select three questions from a wider question bank when the lesson loads.

    Questions and explanations are also available without JavaScript.

    A friend’s profile sends an investment offer requiring urgent payment. What do you do first?

    Why does this matter? A scam can borrow your trust in a friend even when they do not control the message. Even a genuine recommendation does not establish that the investment terms are sound.

    1. Pay because I recognise the profile.

      A familiar profile may have been taken over. This transfers trust in a person to a request whose origin and terms you have not yet confirmed.

    2. Ask for another profile photograph.

      A photograph does not verify who controls the profile or the offer terms. Someone who took over the account can have the same photograph; it does not establish who is asking for money.

    3. Contact my friend on a number I already know and separately check the offer.Correct answer

      Independent checks address both the sender and the offer itself. You separate two checks: whether the message is really theirs and whether the offer itself has verifiable terms.

    An offer is professionally written but does not explain who receives payment. What do you do?

    Why does this matter? Without an identified recipient and clear terms, you cannot assess what you are paying for or whom to approach about a problem. A professional presentation does not supply that missing information.

    1. Do not pay until I establish the recipient and terms.Correct answer

      The recipient and payment purpose should be clear before deciding. Pausing preserves your ability to decide once you know whom you are paying and what the payment is for.

    2. Send a small amount as a test.

      A small payment does not establish that the offer is trustworthy. A trial payment already exposes money and does not verify the promised benefit or the recipient’s identity.

    3. Trust it because there are no spelling mistakes.

      Good writing is not proof of authenticity. Polished writing can conceal missing essential details rather than establish their accuracy.

    You have sent money and now suspect a scam. What takes priority?

    Why does this matter? Promised returns may encourage you to wait even after doubts arise. A refund offer requiring another fee can exploit the same pressure and add another payment to the original loss.

    1. Wait until the promised profit date.

      Delay may reduce the scope for action on the payment. The suspicious transaction will not check itself when the promised deadline expires; the bank needs to know why you are concerned.

    2. Contact my bank or payment service immediately.Correct answer

      The provider can check available options; reimbursement is not guaranteed. The official service can connect your report to the actual transaction and explain what action may still be possible.

    3. Pay a new fee offered in a message to recover the money.

      A new fee could be a continuation of the scam. Wanting the first amount back does not establish the authority of the person now asking for a second payment.

    No registration. Your answers are not sent; the result is just for you.

    Remember

    Check the source, the request and the reason for urgency. Pause if any check is missing.

    Recognise phishing messages

    References

    Sources and further reading

    The fraud patterns and offer checks are based primarily on warnings from the Serbian National CERT. The FTC guide to recognising scams and its refund and recovery scam guidance (United States) add recognition patterns; US reporting routes and refund rules have not been applied to Serbia.

    Content last reviewed