Online Scam Checks | Verify a Suspicious Message Before You Click or Pay — A Practical Workflow for Checking Claims, Preserving Evidence, and Reporting Fraud

A message arrives on WhatsApp. Someone claims you have won

a prize, found a profitable investment, qualified for a job, or must urgently resolve a problem with your bank account. Perhaps a seller offers an unusually attractive price, or a customer sends a screenshot showing that a payment has been made.

The message may look convincing. It may use a familiar logo, a professional design, a Nigerian phone number, or the name of an organization you recognize.

The important question is not whether the message looks genuine. It is whether you can verify its claims independently.

This chapter gives you a repeatable method for checking suspicious messages and online offers before you click, disclose information, transfer money, or release goods. You will also learn how to preserve evidence and report suspected fraud.

The method works for ordinary Internet users, freelancers, online sellers, students, and small businesses.

1. Understand what you are trying to verify

Online scams often exploit one or more of five things:

• Identity: Someone pretends to be a bank, government agency, company, customer, friend, or family member.
• Authority: The sender claims to represent an institution or person you are expected to trust.
• Urgency: You are told to act immediately or lose an opportunity, money, access, or an account.
• Payment: You are asked to send money, pay a release fee, or trust an unverified payment confirmation.
• Information: You are asked to provide passwords, one-time passwords (OTPs), account details, recovery codes, identity documents, or other sensitive information.

A scam does not need to contain spelling errors or look unprofessional. A convincing logo, familiar profile photo, or polished website is not proof of legitimacy. Google and WhatsApp both advise users to examine suspicious links and requests carefully rather than trusting appearances.

References: Google Safety Center and WhatsApp guidance on suspicious messages.

Your objective is to answer three questions:

1. Who is actually behind this message or offer?
2. Can the important claims be confirmed through an independent, trusted source?
3. What is the safest next action if you cannot verify the claim?

2. Use the STOP–CHECK–VERIFY–DECIDE method

Use this four-stage process whenever a message could expose your money, accounts, identity, device, or business to risk.

Stage A: STOP

Do not click the supplied link, download an attachment, scan a QR code, share a code, or send money while you investigate.

If the sender says your account will be blocked in five minutes, treat the urgency as a reason to slow down—not a reason to obey.

Do not call a telephone number supplied in a suspicious message merely because the sender claims it belongs to a bank or government office.

If the message appears to come from someone you know, do not assume the account is still controlled by that person. An account can be impersonated or compromised.

Stage B: CHECK

Read the message carefully. Identify exactly what it is asking you to believe or do.

Write down the claim in plain language:

• “My bank says my account will be suspended.”
• “A company says I have been selected for a job.”
• “A customer says they have transferred ₦50,000.”
• “An online store says I must pay a fee before receiving a prize.”
• “A friend says they urgently need money.”

Then identify the risk. Is the sender asking for money, personal information, account access, a download, or immediate action?

A specific claim is easier to investigate than a vague feeling that something is wrong.

Stage C: VERIFY

Find a trusted route to the organization, person, service, or payment system independently.

For example, open the bank's official app yourself, type a known official website address into your browser, or contact a person using a telephone number you already trust.

Do not use the suspicious message as your only source of contact details.

Stage D: DECIDE

Choose one of three outcomes:

• Verified: Independent evidence supports the claim. Proceed only if the action is otherwise safe.
• Unverified: You cannot establish whether the claim is true. Pause and request confirmation through a trusted channel.
• Suspicious or fraudulent: The evidence indicates impersonation, deception, or an attempt to obtain money or information. Preserve the evidence and report it through the appropriate channel.

You do not need to prove that a message is fraudulent before refusing to act on it. An unverified request is enough reason to withhold payment or sensitive information.

3. How to inspect a suspicious link safely

A message may contain a link that appears to belong to a legitimate bank, delivery company, online marketplace, or government service. The visible text may not reveal where the link actually leads.

Follow this process.

Step 1: Do not open the link.

If the message is unexpected or asks you to sign in, claim a reward, update your banking information, or download an app, leave the link unopened while you investigate.

Step 2: Examine the complete address if you can do so without opening it.

On some phones, you can press and hold a link to see a preview. The available options depend on the app and device. If the preview offers to open the website immediately and you are unsure what it will do, cancel.

Look for:

• Misspelled brand names.
• Extra words added to a familiar domain.
• Unusual domain endings.
• A domain that belongs to a different organization.
• Shortened links that conceal the destination.
• A request to enter credentials on a website you reached through an unexpected message.

For example, a link containing a brand name somewhere in its address does not necessarily belong to that brand. Read the actual domain, not just the familiar word.

The padlock or HTTPS connection alone does not prove that a website is honest. Scam websites can also use encrypted connections.

Step 3: Navigate independently to the real service.

Open the service's official app or type its known address yourself. Find the relevant account notice, offer, transaction, or support information there.

If a message claims that a bank needs you to update your account, check through your banking app or an independently obtained official contact channel—not through the supplied link.

Step 4: Use a reputation check as supporting evidence.

Google Safe Browsing provides information about its website safety protections and a Site Status diagnostic tool:

https://transparencyreport.google.com/safe-browsing/search

You can use this to check whether Google has identified a site as dangerous. However, a site that receives no warning is not guaranteed to be legitimate. New or previously undetected scam websites may not yet be flagged.

Never enter your password, OTP, payment information, or personal documents into a suspicious site simply because a safety checker has not flagged it.

Reference: Google Safe Browsing.

4. Verify the organization or person behind the offer

A genuine-looking profile or website can still be misleading. Verify the identity through information that does not originate from the suspicious message.

For a bank, government agency, or established company

1. Search for the organization's official website independently.
2. Check whether the domain is the one the organization actually uses.
3. Navigate to its contact or support page.
4. Check whether the specific offer, warning, or announcement appears in its official channels.
5. Contact the organization using independently obtained details if the claim could affect your money or account.

Be cautious when searching for customer support numbers. Fraudulent advertisements, copied websites, and unofficial directories can lead you to impostors. Prefer the contact details published in the organization's verified app or official website.

For a job, grant, prize, or investment

Check the exact program name, the organization responsible, eligibility requirements, and the official application process.

Ask yourself:

• Can I find the opportunity on the organization's independently verified website?
• Is the sender using an official communication channel?
• Are the terms, deadlines, and requirements consistent across independent official sources?
• Is there an unexplained payment before a job, prize, grant, or investment can be accessed?
• Is the sender promising guaranteed returns or pressuring me to recruit others?

A request for money does not automatically prove fraud in every context. However, unexplained advance fees, guaranteed returns, secrecy, and pressure to act quickly are reasons to investigate carefully.

For investments and financial services, check the relevant regulator's official records where applicable. A professional-looking website or a certificate image supplied by the promoter is not independent proof of authorization.

For a friend, family member, or customer

Contact the person through a different channel you already trust. If a friend sends an unusual request for money, call their previously known number or speak to them in person before transferring anything.

If a customer claims to have paid, verify the transaction through your own bank or payment provider. A screenshot, SMS forwarded by the customer, or payment receipt image is not sufficient evidence by itself.

5. How to verify a payment before releasing goods or services

This is particularly important for Nigerian online sellers, freelancers, delivery businesses, and service providers.

Imagine that a customer orders a product and sends a screenshot showing a successful transfer. They then ask you to release the item immediately.

Use this checklist.

Step 1: Open your own banking or payment app.

Do not follow a payment link supplied by the customer. Open your own trusted app or use your provider's independently verified channel.

Step 2: Check your actual transaction records.

Look for the incoming transaction in your account activity. Check the amount, date, status, and any available transaction reference.

Step 3: Match the transaction to the order.

Confirm that the amount and reference correspond to the customer and order you are processing. Investigate discrepancies instead of assuming they are harmless.

Step 4: Confirm the status.

A screenshot may be fabricated, altered, outdated, or show a transaction that is pending or unsuccessful. If the transaction is not visible or its status is unclear, contact your bank or payment provider through an official channel.

Step 5: Release the goods or service only after your own verification.

Create a simple business rule: no dispatch, handover, or confirmation of payment until the funds are confirmed through your own payment records, subject to your provider's settlement and transaction rules.

If the customer pressures you, remain polite and consistent. A legitimate customer should be able to wait for reasonable payment verification.

Step 6: Record the outcome.

Maintain an order register with the order number, customer reference, amount expected, amount received, transaction reference, verification status, and fulfilment status. Restrict access to this record and avoid storing unnecessary sensitive banking information.

This procedure helps protect revenue and reduce disputes. It does not guarantee that every transaction is irreversible; follow your bank or payment provider's guidance if a transfer is disputed or later identified as fraudulent.

6. How to preserve evidence without increasing your risk

If you suspect fraud, keep useful evidence before deleting messages or blocking an account—provided doing so does not expose you to immediate danger.

Preserve:

• Screenshots showing the message, sender details, date, time, and relevant claims.
• The complete suspicious website address, if you can record it safely.
• The sender's phone number, account name, profile details, or business identity.
• Transaction references, bank alerts, receipts, and relevant account statements.
• Emails with their original sender information where possible.
• A brief timeline describing what happened and what actions you took.

Keep the original messages or files when possible. Do not edit the only copy of your evidence. Store copies somewhere secure and accessible to you.

Do not publicly post another person's private information, identity documents, account details, or unverified accusations as a way of seeking justice. Share relevant evidence with your bank, platform, or appropriate authorities instead.

If you need to preserve a WhatsApp conversation, the official help guidance explains that screenshots and chat backups may help retain a record. See WhatsApp's reporting and blocking guidance.

7. How to report a suspicious WhatsApp account or message

WhatsApp offers in-app tools for reporting suspicious contacts, businesses, messages, and groups. The precise menu layout can vary by device and app version.

To report and block a suspicious contact

1. Open WhatsApp.
2. Open the chat with the suspicious sender.
3. Tap the sender's name or the chat's menu to open the available contact or chat options.
4. Choose Report or the relevant reporting option.
5. If offered, select the option to block the sender as well.
6. Confirm the action and follow the on-screen instructions.

On some versions, the route may be available through the three-dot menu. On others, it may be under the contact information screen.

Reporting and blocking are different actions. Reporting sends relevant information to WhatsApp for review; blocking prevents that account from contacting you through WhatsApp in the usual ways. Reporting does not guarantee that WhatsApp will ban the account.

WhatsApp says a report may include the account or group ID and up to five of the most recent messages sent by the reported user. The reported person is not notified that you reported them.

For a business account, open the business chat, tap the business name to view its profile, and look for Report Business. Follow the on-screen instructions.

Official instructions: How to block and report someone and How to report a merchant for fraud.

Do not continue arguing with a suspected scammer to obtain a confession. Preserve the evidence, report the account, and stop engaging.

8. What to do if you have already paid or shared sensitive information

Act quickly. The appropriate response depends on what happened.

If you transferred money

1. Contact your bank or payment provider immediately through its official app, known telephone number, or official website.
2. Explain that the transaction may be fraudulent and provide the transaction reference and supporting evidence.
3. Ask what protective steps are available, including whether the transaction can be recalled, disputed, or investigated. Recovery is not guaranteed.
4. Follow the provider's instructions and retain the case or complaint reference.
5. Report suspected criminal activity to the appropriate authorities.

Do not pay a stranger who promises to recover your money for an advance fee. Recovery scammers often target people who have already suffered a loss.

If you disclosed a password, OTP, or account recovery code

• Contact the affected service through its official recovery process.
• Change the compromised password from a trusted device.
• Secure the associated email account, since it may be used to reset other accounts.
• Review active sessions, linked devices, recovery details, and recent account activity where those options are available.
• Revoke suspicious sessions or linked devices.
• Enable two-step verification or multifactor authentication where supported.
• If banking information was exposed, contact your bank immediately.

Never share an OTP or account recovery code with someone who contacts you unexpectedly and claims to be helping you.

If you installed an unfamiliar app or file

Stop using the suspicious app and avoid entering further credentials into it. From a trusted device, secure any accounts whose information may have been exposed. Review the phone's installed apps and permissions, use the device's built-in security tools, and seek reputable technical assistance if you suspect the device has been compromised.

If you cannot safely determine what the app did, do not assume that deleting it alone has resolved the problem.

9. Reporting suspected cybercrime in Nigeria

For suspected financial fraud, contact your bank or payment provider first when money or banking access is at risk. Then consider reporting the incident to the appropriate law-enforcement or regulatory authority.

The Nigeria Police Force National Cybercrime Centre (NPF-NCCC) provides a cybercrime e-reporting portal:

https://nccc.npf.gov.ng/ereport/

Use the official address directly rather than following a link supplied by a suspected scammer. Review the portal's current reporting instructions, provide accurate information, and retain any reference it supplies. Do not assume that filing a report guarantees a refund or immediate recovery.

The Central Bank of Nigeria also provides consumer education on fraud and scams, including the importance of contacting your financial institution promptly when you suspect fraud.

• NPF National Cybercrime Centre e-reporting portal
• Central Bank of Nigeria: Fraud and Scam Awareness
• Central Bank of Nigeria: Consumer Education

If a case involves a bank or regulated financial service provider, use the provider's formal complaint process and consult the relevant regulator's official guidance if the complaint remains unresolved. Keep copies of your complaint and all responses.

10. Create a personal or business scam-check record

You do not need expensive cybersecurity software to make your verification process more consistent. A basic document or spreadsheet is enough.

Create a record with these columns:

Field	What to record
Date and time	When the message or incident occurred
Sender	Phone number, account name, email, or claimed organization
Claim	What the sender wants you to believe
Requested action	Click, pay, sign in, download, share information, or something else
Verification method	Official app, independently found website, known contact, or provider records
Evidence	Screenshot, transaction reference, or saved correspondence
Decision	Verified, unverified, or suspicious
Action taken	Ignored, reported, blocked, bank contacted, or other response
Follow-up	Complaint reference, next step, or resolution

Do not store passwords, OTPs, full card details, or unnecessary identity information in this record. Keep it private and restrict access if it contains customer or business information.

For a small business, turn the workflow into a written procedure that anyone handling orders or payments can follow. This reduces the risk that an employee or family member will release goods based on a convincing screenshot or an urgent message.

11. Common mistakes that weaken scam checks

Trusting a logo or profile photo. Images can be copied. Verify the person or organization through another channel.

Assuming a familiar phone number proves identity. Accounts can be compromised, and caller identity can be misrepresented.

Treating search results as proof. A website may appear in search results and still be fraudulent. Check the exact domain and independent official sources.

Assuming a safety checker guarantees legitimacy. A tool may not yet recognize a newly created malicious website.

Paying a small fee to test an offer. A small initial payment may be used to build trust before a larger demand.

Deleting everything immediately. You may lose useful evidence. Preserve relevant records when safe, then block or report the sender.

Waiting to report a financial loss. Contact your financial institution as soon as possible. Delay can reduce the options available.

Assuming a report guarantees action. Platform reports and law-enforcement complaints are important, but outcomes depend on the evidence, investigation, and circumstances.

12. Practical exercise: Investigate a suspicious message

Imagine you receive this message:

Congratulations! Your account has qualified for a ₦250,000 reward. Confirm your details within 15 minutes using the link below. A small verification fee may apply.

Do not click the link. Use the workflow to answer the following questions.

1. What is the message asking you to believe?
2. What pressure tactic is it using?
3. What information or money could be at risk?
4. How would you independently verify the organization and the reward?
5. Which evidence would you preserve?
6. If the message arrived on WhatsApp, how would you report it?
7. What would you do if you had already entered your banking details?

A good investigation does not depend on guessing whether the sender is dishonest. It depends on refusing risky actions until the claims have been independently verified.

Your assignment: Create a one-page scam-check checklist for your phone or business. Include the STOP–CHECK–VERIFY–DECIDE method, the official channel you would use to verify a bank-related claim, the procedure you would follow to verify a customer payment, and the steps for preserving evidence and reporting a suspicious WhatsApp account.

Test the checklist against three fictional examples: a suspicious job offer, an unexpected payment screenshot, and a message pretending to come from a bank.

The principle to keep

The Internet can help you find customers, sell products, build professional skills, and manage your money. But every online opportunity carries a question of trust.

You do not need to become a cybersecurity expert to make safer decisions. You need a reliable process that prevents urgency, appearance, and social pressure from replacing evidence.

Verify independently. Protect your information. Confirm payments through your own records. Preserve evidence. Report suspected fraud through official channels.

That is how online safety becomes a practical skill—and how protecting the value you create online becomes part of your Internet Money system.

Further reading

• WhatsApp: About suspicious messages and scams
• WhatsApp: Reporting and blocking
• Google Safety Center: Security tips
• Google Safe Browsing
• Central Bank of Nigeria: Fraud and Scam Awareness
• Nigeria Police Force National Cybercrime Centre 

Image: Facebook