---
title: Recognize phishing and fake Tapmy messages
description: How to spot a phishing email or fake Tapmy message, check it safely, and what to do if you already clicked a link or replied.
lead:
  - A fake Tapmy message usually rushes you, threatens you, or asks for a password, code or payment detail. Tapmy support never needs those, so open Tapmy yourself instead of using the message's link.
tags:
  - payments-fees
source: docs/tapmy-wiki/pages/recognize-phishing-and-fake-tapmy-messages--da04cc5d.md
---

## What should I do first with a suspicious message? {#before-you-start}

Stop. Do not click, reply, download an attachment, scan a QR code or call a number in the message. Keep it as evidence. If you already interacted with it, jump to "What if I clicked or replied?" below and read **Report a compromised account**.

## How can I tell a message is fake? {#warning-signs}

Fake messages tend to share a few habits. Watch for a message that:

- says your account or payout will be suspended unless you act now;
- offers a surprise refund, award, verification or customer lead;
- asks for a password, one-time code, recovery code, API key, full card number, CVV, bank login or ID document;
- carries a login form as an attachment or QR code;
- comes from a look-alike or misspelled domain;
- hides the real link behind a shortener;
- wants you to install remote-access software or a browser extension;
- changes payment, payout, domain or billing details outside your account;
- has odd grammar, off-brand logos or a strange reply address;
- asks a buyer to pay somewhere other than the creator's own checkout.

One warning sign is not proof. A request for a password or code is enough to stop talking to the sender.

## How do I check a message safely? {#verify-safely}

1. Open Tapmy from a bookmark or type the address yourself.
2. See whether the alert or task the message mentions shows up in your account.
3. Read the sender address and link text letter by letter, without opening the link.
4. For an offer-specific message, contact the creator through their public site.
5. For a claim about Tapmy, use the Help Center or support page you already know.
6. For a payment-account claim, go to Stripe through your own Stripe login.
7. If it seems to come from a teammate, ask them on a different channel.

Do not forward a risky attachment to coworkers. If you need to report it, share a screenshot or the message header through a proper reporting route, with unrelated personal data blacked out.

## What if I clicked or replied? {#if-you-clicked-or-replied}

Close the page and type nothing more into it. From a device you trust, change any password you entered. Then remove unknown sessions and connected apps, check your email for forwarding rules, look over your public site and payout settings for changes, and watch customer messages. If you gave card or bank details, call that provider using the number on its official site.

## How do I know I handled it well? {#what-success-looks-like}

- You confirmed the claim through a source you opened yourself.
- You gave the sender no secrets.
- You kept the message and timestamps.
- You secured any credentials or sessions that were exposed.
- One report holds the evidence.

## Why can a fake still look real? {#troubleshooting-and-limits}

Sender names and logos are easy to forge. A padlock or HTTPS does not prove a site belongs to Tapmy. A scam message can also quote real public details. When you are unsure, wait. Genuine support can help without your password or one-time code.

## Where do I report it? {#next-steps}

Send it to [Tapmy Support](/help/tapmy-support) with the sender, subject, time, the link written out as text, and a redacted screenshot. If credentials may be exposed, follow **Report a compromised account** straight away.