Fake Payment Links: The Smart Bit That Cleans Out Accounts

The digital revolution promised us convenience. It promised that our old-fashioned leather wallet, filled with crumpled bills and heavy coins, would become a distant memory. And indeed, the revolution delivered. Today, our money is rows of code, it is a 'ping' on the phone, it is a quick click on a purple or blue button in an app. But in this rapid transition from the material to the virtual, we have lost something very fundamental: the ability to feel the money leaving our hands. When you hand over a hundred-shekel bill, you feel the loss. When you click on a payment link, you feel only technological satisfaction. And this gap, between the sense of digital security and the vulnerable reality, is the home turf of fake link scammers.

In previous chapters, we dealt with scams based on physical products or couriers at the door. Here, in Chapter 38, we dive into the most elegant and dangerous scam in the world of online commerce today. This is a scam that does not require the fraudster to come to your home or even send an empty package. It requires only one thing from them: that you click on the wrong link. This link, which looks exactly like the real thing, is the modern-day 'Trojan horse,' and it is capable of emptying bank accounts in a matter of minutes, bypassing even the most sophisticated defense mechanisms you have constructed in your mind.

The following scenario is an educational example based on common fraud patterns. The characters and events are for illustration purposes only.

The Story of Alon: When the Buyer Was 'Too Nice'

Alon, a 34-year-old software engineer from Haifa, was considered a technological expert by his friends. He is the one who installs their routers, he is the one who warns them about suspicious emails, and he is the one who manages all his financial affairs through the most advanced apps. When Alon decided to sell his professional mirrorless camera on a secondhand website, he never imagined he would find himself at the center of a scenario illustrating the dangers of digital fraud.

The ad he posted was professional. A fair price, high-quality photos. Within less than an hour, a WhatsApp message arrived. 'Hi Alon, is the camera still available? I’m looking for exactly this one for my wife, a birthday gift,' wrote 'Idan.' Idan's WhatsApp profile picture showed a smiling man with a child in his arms.

'Yes, it’s available,' Alon replied. 'I’m from Haifa, where are you from?'

'I’m from Ramat Gan,' Idan replied, 'but I’m really pressed for time. If the camera is in good condition as you described, I’ll buy it now. I’ll send a courier to pick it up from you, so we don’t inconvenience each other. What do you say?'

Alon hesitated. He preferred a face-to-face meeting, but the offer was tempting. 'How will you pay?' he asked.

'I will send you payment now through the payment app's link service,' Idan wrote. 'It’s the safest for both of us. As soon as you confirm receipt of the money, the courier will head your way. That way, you have the money in hand before the camera leaves the house.'

A minute later, Alon received an SMS message announcing receipt of payment and including a link to confirm and transfer to the account. The link looked legitimate: the colors were familiar and the logo was identical to the original. Alon clicked.

He was directed to a page that looked exactly like the app’s interface. 'In order to verify your identity and complete the fund transfer,' the page read, 'please enter the credit card details to which you would like the money to be deposited, as well as the verification code that will be sent to you by the bank via SMS.'

Alon paused for a moment. Why would a credit card be needed to receive money? But then he remembered that the app had options for withdrawals to a card. He wanted to get it over with and entered the details. Within seconds, an SMS arrived from the bank with a verification code to perform an action. Alon entered the code on the site. The screen showed a loading icon, and then an error message about a communication failure.

Alon tried to write to Idan that the link wasn't working, but Idan was no longer online and his profile picture had disappeared. Within minutes, alerts began to arrive from the bank about high-value transactions made abroad. In less than five minutes, Alon's credit limit had been fully utilized.

Alon did not receive money for the camera. In this scenario, he gave the fraudster access to his payment method without meaning to, all while believing he was just 'confirming receipt of payment.'

The Anatomy of the Fake Link: Why Do We Fall for It?

The fake link (Phishing/Spoofing) scam is based on social engineering. It does not rely on hacking into bank computers, but on exploiting human behavioral patterns. Throughout his professional work and while supporting many victims of fraud, three pillars upon which this method relies can be identified:

1. Interface Spoofing (UI)

Fraudsters use web designers who copy the source code of well-known landing pages. The human brain, which is accustomed to recognizing patterns, identifies the familiar colors and logo and concludes that it is a legitimate service.

2. URL Manipulation

This is the main technical failure. Many users do not examine the website address in depth. Fraudsters use techniques such as:

• Typosquatting: Using a small typo in the website address.
• Subdomains: Creating a subdomain that looks reliable but belongs to a foreign domain.
• Link Shortening: Using link-shortening services to hide the true destination.

3. Creating Urgency and Role Confusion

The fraudster turns the tables: instead of the seller asking for money, the buyer 'sends' money. With the feeling that we are on the 'winning side,' our defenses drop. The artificial urgency prevents the victim from stopping to think why credit card details are required to receive payment in an app based on a phone number.

Legal Analysis: Who Is Responsible When the Money Disappears?

When victims of fraud seek assistance, the first question that usually arises is whether the bank's liability can be examined and what the possibilities for restitution are. The legal analysis is performed, among other things, through the prism of the Payment Services Law, 2019.

Defining an 'Unauthorized Transaction'

The law distinguishes between a situation where a person performed a transaction themselves and a situation where a payment method was used without authorization. In the case of a fake link, it is a complex situation: the victim entered the details, but they did not grant authorization for the specific transaction the fraudster actually performed.

Responsibility for Misuse

The Payment Services Law states that if a payment method is used without authorization, the customer may not be held responsible for this use, subject to certain conditions. However, there is the issue of 'gross negligence.' Financial institutions may argue that providing a verification code sent via SMS constitutes gross negligence. Conversely, in legal representation of the victim, one can examine the argument that this is sophisticated social engineering that even a reasonable person might fall for.

Distinction Between 'Payment Instruction' and 'Receipt of Payment'

The legal options can also be analyzed through the question of whether banking systems are sufficiently protected against 'mirroring.' If the fraudulent site manages to pull a verification code in real-time, the liability of the payment service provider might be examined due to a possible failure in security mechanisms.

It is important to emphasize: There is no blanket guarantee of restitution, and the outcome depends on the circumstances of the case. Examination of the case may include the user's proficiency, the quality of the forgery, the speed of reporting, and the actions taken by the financial institutions.

Technology at the Service of the Fraudster: How Does the 'Real-Time Capture' Mechanism Work?

To understand the modus operandi, one must be aware of the use of 'Reverse Proxy' servers or real-time phishing tools:

1. Capture: As soon as the user enters details on the fake site, the fraudster enters them simultaneously on a legitimate site.
2. The Code: The legitimate site sends a verification request to the bank, and the bank sends an SMS to the user.
3. Mediation: The user enters the code on the fake site thinking they are authorizing one action, while the fraudster 'captures' the code and enters it on the legitimate site to perform a different action.
4. Completion of Transaction: From the system's perspective, all required verification data has been received and the transaction is approved.

Legal Aspects of P2P (Peer-to-Peer) Apps

Payment apps are defined as 'payment services.' When a transfer is made voluntarily, even if as a result of deception, the ability to cancel the transaction (Chargeback) may be more limited than in a standard credit card transaction with a merchant. The app functions as a conduit for transferring funds, and if the action was approved by the user, it may claim it has fulfilled its contractual obligation.

In these cases, the legal analysis may focus on whether the bank acted with the required level of care in identifying anomalous activity patterns in the account.

When Might a Chance for Restitution Arise?

• Immediate reporting that allows for the stoppage of transactions that have not yet been finally cleared.
• Cases where the fake link was distributed through a breach of the systems of well-known entities.
• Proven technical failures in the payment provider's verification mechanism.

How to Identify the Trap? (Warning Signs)

One can look for signs indicating an attempted scam:

• Unusual Data Request: Receiving money in apps does not require entering full credit card details and a CVV code.
• Communication Outside the App: Suspicion of SMS messages with external links instead of internal notifications in the app.
• Suspicious URL: Checking the address extension and looking for slight changes in the domain name.
• Pressure from the Other Party: Attempts to expedite the action under the pretext of 'urgency.'
• Linguistic Errors: Non-standard grammar or phrasing that indicates machine translation.

What to Do If You Have Fallen Victim (Immediate Actions)

In case of suspicion of falling for a scam, time is a critical factor:

1. Immediate Blocking: Contacting the bank or credit card company to block the payment method and digital access.
2. Documentation: Saving screenshots of the messages, links, and correspondence.
3. Filing a Police Report: Obtaining confirmation of filing a report (this can be done online).
4. Changing Passwords: Updating passwords for sensitive services from a secure device.
5. Checking Account Settings: Verifying that no new devices or unknown permissions have been set up in the bank account.

Professional Advice

After taking the urgent actions, legal options vis-à-vis financial institutions can be examined. A professional examination of the case circumstances may lead to an analysis of the failures in preventing the fraud and evaluating the chances for a settlement or compromise for the restitution of funds.

The basic rule in managing digital risks is extreme caution: money being transferred to you should not require you to provide full access details to your payment method.