Fake PayID payment email: is it real, and what do you do tonight?

It’s late. You’ve listed a ute, a coffee machine or a pallet of stock, a buyer says they’ve paid by PayID, and an email lands saying the money is “held” until you upgrade to a business account. Your stomach drops, because it looks official. Here’s the short version: it’s a scam, and the fix is one check that takes under a minute.

Is a fake PayID payment email real?

No, and there’s no grey area. PayID’s own page says: “PayID will never contact you directly. Not ever.” It also says emails or text messages claiming to be from PayID are a scam, and that PayID “will never ask you to send money to receive money or ask you to ‘upgrade your account’.”

So any message that says one of these things is a scam, however good the logo looks:

• Your PayID payment is “pending” or “on hold” until you pay a fee.
• You need a “business” or “premium” PayID to receive a larger amount.
• The buyer has “overpaid” because of the limit, and you need to send the difference back.
• A “PayID support agent” will release the funds once you verify your account.

How do you check in 60 seconds whether you’ve been paid?

Ignore the email completely and open your own bank’s app, not a link in a message. Then:

1. Look at your transaction list and balance. Real PayID payments are NPP payments. The RBA says the NPP gives recipients funds “on a 24/7 basis”, in close to real time. That means Saturday midnight is no different from Tuesday lunchtime.
2. No money in the app means no payment. A scam email can’t put money in your account.
3. Check the payer’s name. If the name on the credit doesn’t match the buyer you’ve been talking to, stop and ask why.
4. Don’t reply or click. A reply tells the scammer your number is live. A link can lead to a copy of your bank’s login page.

That’s the whole defence. The scam only works if you believe the email over your own account.

How does the scam work on a business?

Most write-ups were aimed at people selling on Marketplace. The same script now hits sole traders and small firms that sell equipment, vehicles, stock, tools or surplus online. A typical run goes like this:

Step	What the “buyer” does	What’s really happening
1	Agrees the price fast and asks for PayID	They never intended to pay
2	Sends a fake “payment failed” or “upgrade” email	The email is theirs, not PayID’s
3	Says you need to pay a fee or refund an “overpayment”	The money that moves is yours
4	Offers a courier or friend to collect today	They want the goods before you check

The timing is deliberate. It tends to happen on a Friday night, on a weekend or the evening before a public holiday, when it feels like you can’t ring anyone and the buyer is “leaving town”. Pressure is the product.

Selling something you’d rather not hold over a weekend? Slow down instead. A real buyer will wait until the money is visible in your app.

What if the money really is still missing?

Sometimes a genuine payment is delayed or held. Banks can hold some payments for security checks, especially large first payments to a new payee. Our page on first-payment holds explains how that looks.

The difference is who tells you. A bank hold is shown in your bank’s own app or by your bank. It never comes with a request for you to send money, and it never needs you to “upgrade” anything. If you want the full picture of how fast payments behave on weekends, see PayID, Osko and fast payments.

What should you do at 11pm if you’ve already sent money?

Don’t wait for the morning. Speed is what gives a bank any chance of recalling a payment.

1. Ring your bank’s fraud or scam line now. Use the number on the back of your card or on the bank’s official site, not one from the email. Most major banks run these 24/7.
2. Tell them it’s a scam payment and give the time, amount and payee details. Ask them to try to recall or freeze it.
3. Change your internet banking password if you clicked a link or typed any login details.
4. Report it to Scamwatch, and for a business, to ReportCyber, the Australian Signals Directorate’s reporting portal.
5. Screenshot everything: the listing, the messages, the email headers and the payment receipt. Don’t delete the conversation.
6. Tell your bookkeeper or co-owner so nobody else pays the “fee” or ships the goods.

If you’re a business owner who also got a call from someone offering “help to recover your money”, treat that as a second scam. Our guide on telling a real lender call from a scam covers the checks.

Will your bank cover the loss?

Not automatically today. The Scams Prevention Framework Act has been in place since February 2025, and banks were designated under it from 23 May 2026 (ASIC). But the detailed bank code and rules were still draft when this was written, and most of the new bank obligations are expected to start from 31 March 2027. Treat that as a direction of travel, not a safety net for tonight. Report quickly, and expect the bank to ask what checks you made.

How do you stop it happening again?

A few habits make the scam fail before it starts:

• Write a one-line rule for the business: “We release goods when the money is in our app, not when someone shows us a screen.”
• Never pay to receive. No legitimate payment system asks for a fee, a refund or an upgrade first.
• Keep the buyer’s name and the payer’s name side by side before you hand anything over.
• For big sales, wait one business day if you can’t see cleared funds, or take payment in person at a bank branch.
• Brief staff who list and sell items for you. The person who answers Saturday messages is often the one who gets caught.
• Review any PayTo requests before approving. They are a different tool and our PayTo page shows what a real one looks like.

Illustrative example: a Friday-night excavator attachment

Illustrative example only; no real people or businesses are described.

A landscaping business lists a spare trenching attachment. At 9pm on a Friday a buyer agrees the price and says he’s paid by PayID. An email follows from “PayID Support” saying the funds are held until the seller pays a $150 upgrade fee. The buyer messages, “My mate’s picking it up in an hour, just sort the fee and it’ll clear.”

The owner opens her banking app instead of the email. There’s no credit. She replies once: “I’ll release it when the funds show in my account.” The buyer’s messages stop. She screenshots the thread and reports it to Scamwatch on Saturday morning. Nothing was lost, because the account said what the email wouldn’t.

What if a scam has left a hole in your cash flow?

A lost deposit, a payment you can’t recover or a stalled sale can dent cash flow just when wages, rent or a supplier is due. If that’s where you are, it helps to know that funding options exist, and that a real person will look at your situation, not a script. See the Next 24 hours tool to map what happens when, or check your options here.

Check the account first, then check your options

Scams like this one rely on tiredness, hurry and a closed bank. Most business owners who get caught aren’t careless. They’re trying to close a sale on a Friday night. The best protection is boring: the app is the truth.

And if a scam or a bad week has left a gap you need to cover, we’re awake when you are. The enquiry takes about 60 seconds, and there’s no credit check just for asking, so your credit file stays untouched. Your details go to one team rather than a pile of lenders, so your phone won’t light up with calls you didn’t ask for. A real person reads your situation and calls you on the next business morning. Please fill the form in accurately, so we can point you to the right option first time.

See if you qualify →