How should people verify a virtual money request before sending funds through a chat app or QR code?

How to check a money request before you send anything

A request for money in a chat app should be treated like a fraud attempt until proven otherwise, especially if it arrives with urgency, secrecy, or a QR code. The safest approach is to verify the person and the purpose through a separate channel you already trust, then use only the official payment flow after you have confirmed the request is genuine.

That matters because chat messages and QR codes are easy to fake, forward, or place into a conversation that looks authentic. The real decision is not whether the message looks plausible, but whether the recipient, the amount, and the payment destination have been independently confirmed.

When the request includes a QR code, the risk is not the code itself but the destination behind it. A code can send you to a fake payment page, a lookalike recipient, or a flow designed to make you act before you think. NHIMG’s QR Code Phishing (Quishing) Guide covers why QR-based lures work and how to spot the common evasion patterns.

What to verify before approving the payment

Start with the sender, not the message. Confirm that the person asking for money is actually who they claim to be, and do it through a different route such as a phone call, known email address, or in-person confirmation. If the request is from an organisation, use contact details from the organisation’s official website or your own records, not details embedded in the message.

Then verify the payment destination. Check the recipient name, handle, account, or merchant details inside the official app before you send funds. If anything about the destination differs from what you expected, stop and re-confirm. A legitimate request should survive that check without pressure, confusion, or a last-minute change in account details.

Do not use links or attachments from the message to complete the payment, and do not enter banking details into a page reached from a chat thread. If the request belongs in a payment app, open the app yourself and navigate to the recipient from there. That keeps the trust decision inside the app you control, not inside the message the requester sent.

Why chat and QR scams succeed

These scams work because they compress trust, timing, and payment into a single moment. A chat message can mimic a known contact, borrow the tone of a real conversation, or pressure the recipient to act quickly. A QR code adds another layer of convenience, which can hide the fact that the final destination has never been checked.

For practitioners, the key failure is assuming that a familiar channel equals a verified request. Chat platforms are useful for coordination, but they are not proof of intent. When payment is involved, the verification step has to happen outside the message thread, because the thread itself may be the thing under attack.

That is why cross-checking matters even when the message appears to come from someone you know. NHIMG’s Collaboration Tool Security Guide explains how chat phishing and message compromise can make an internal conversation look legitimate while the request itself is fraudulent.

Practitioner Guidance

What to verify: Confirm three things before any transfer, the sender’s identity, the reason for the request, and the recipient inside the official payment app. If any one of those cannot be independently confirmed, treat the request as unverified and do not pay.

Decision rule: If the request arrived only through chat or a QR code, do not use that same channel to authenticate it. Move to a separate channel you already trust, and if the request still stands, complete the payment only through the official app after checking the recipient details again.

Common mistake: People often verify the tone of the message instead of the underlying payment instruction. A convincing chat, a familiar display name, or a working QR code is not enough if the destination, amount, or urgency has not been independently confirmed.

Practitioner takeaway: The safest habit is to separate communication from approval, because a request can look authentic while the payment destination is still untrusted.

Related resources from NHI Mgmt Group

• How should people verify that a crypto donation request is legitimate before sending funds?
• How should finance teams verify a wire transfer request before releasing funds?
• What should teams verify before sending FATCA data through IDES?
• How can financial institutions detect APP fraud before money leaves the account?