Visa Click to Pay email scam: how to spot the fake security alert
Quick answer
An email that uses the Visa or Click to Pay name to ask for card details or a one-time code is a scam. Visa says it doesn't ask for card details by email. Don't click. Open your bank or card app yourself, and report the email to Visa.
- Comes by
- Email, Phone call
- Pretends to be
- Visa
- Last updated
How it works
Click to Pay is a real checkout feature. Scammers borrow its name to make an email look like it comes from Visa.
Visa's own guidance describes the tells: an email address that doesn't match the organization, a message that doesn't use your name, and a deadline with a threat to suspend your account. The goal is to get your card number, your login or a one-time code.
That last one matters. Visa's FAQ says the real Click to Pay login sends a one-time code to your email address or registered phone number when you enter your email at the login screen. So a code you didn't ask for, or a caller or email asking you to read one back, is a warning sign. Visa also notes that attackers who get into a cardholder's email account can receive those codes themselves.
Red flags
- An email about Click to Pay or your Visa card that you weren't expecting
- A sender address that doesn't match Visa or your bank
- A generic greeting instead of your name
- A deadline, or a threat to suspend your account or card
- A request for your card number, login or a one-time code
- A caller or email asking you to read a code back to them
Example message
Visa Click to Pay security alert: we noticed unusual activity on your card. Confirm your details within 24 hours or your account will be suspended. Verify now: [link]
What to do
- 1
Don't click or reply
Leave the link alone and don't share a code, even if the email uses your card's last four digits. Delete it or keep it for your report.
- 2
Check your card yourself
Open your bank's app, or use the website or phone number on the back of your card. Don't use anything from the email.
- 3
If you gave card details, call your card issuer now
Use the number on the back of the card, say you shared details with a scammer, and ask for the card to be blocked and replaced.
- 4
If you shared a one-time code or login, change your passwords
Change your email and bank passwords, and turn on two-step verification where you can.
- 5
Report it
Send the email to Visa's phishing report address from its Report Phishing page, and report it to your national scam reporting service.
Report it
Check if your details are exposed with Serus
Scammers find your number and address on data brokers and people-search sites. Serus removes them.
Why you got it
Scammers need a way to reach you, and names, phone numbers, email addresses and home addresses are easy to find on people-search sites and data broker listings or in old data breaches. The fewer places your details are listed, the fewer scammers can reach you with a message that looks personal. Serus finds the sites that list you and removes your data, and alerts you when your details show up in a breach.
Frequently asked
Does Visa email people asking for card details?
No. Visa says it doesn't request card details by email, and it won't call or email cardholders to ask for personal account information.
I got a one-time code I didn't ask for. What now?
Don't share it with anyone. Visa's FAQ says the code is sent when someone enters your email at the Click to Pay login, so it may mean someone is trying to use your email. Change your email password and check your card account.
Is Click to Pay itself a scam?
No. It's a real checkout service from the card networks. Scammers copy its name. If you're unsure whether an email is real, go to your bank directly.
The email has my card's last four digits. Is it real?
Not necessarily. Scammers can get partial details from earlier breaches. Check your account through your bank's app instead.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
