Fraud prevention

What makes a password hard to guess

• Long beats complicated. Four unrelated words is stronger and easier to remember than a short string of symbols.
• Unique to QuestPay. If you reuse it anywhere else, a breach somewhere unrelated becomes a breach of your account here.
• Never based on anything personal, e.g. family names, pets or pet names, favourite sports teams, any part of your address, or a significant family date.
• Never a variation of something you have typed a hundred times before. Attackers try every keyboard walk and every common substitution first.

Then add the second lock

• Turn on two-factor authentication in your account settings. It means a stolen password is not enough on its own.
• Never approve a two-factor prompt you did not trigger. If a code arrives and you are not signing in or paying, it is an attack - change your password immediately.
• Use a password manager, or at minimum a password manager's generator. There is no reliable way to invent a strong unique password by hand.

What to look for

• The domain is our domain and nothing else. Read it left to right, from the first character after the https://. Watch for a lookalike prefix, a lookalike extension, or extra words before the real domain.
• A padlock is not enough. A padlock only means the connection is encrypted - anyone can get one for a site they control.
• If you reached the site from a link in a message, do not trust the message. Type the address yourself, or reach us through a link you already trust.

If in doubt, close the tab and start again

There is no penalty for typing our address yourself instead of using a link. There is a very large penalty for entering your card into a lookalike site.

A problem that does not exist

• "Your transfer is on hold. Pay a verification fee to release it." There is no verification fee. If a transfer is genuinely held, it says so on the transfer in your account.
• "Your account will be closed in 24 hours unless you verify." We do not create deadlines to pressure you.
• "Your recipient has been charged. Refund required - reply with your card number." We never ask for a card number by message.

A stranger asking for your money

• Someone you have never met contacts you online and asks you to send them a money transfer, with an offer to return all or part of it. The returned part is stolen money, and the request to send onward is a money mule offence - which is yours, not theirs.
• A new "employer" who pays you to forward transfers, or to receive money and pass it on. There is no legitimate version of this.
• An investment or trading opportunity that pays a guaranteed return and asks you to fund it by transfer. Guaranteed returns do not exist.

Impersonation

• Messages from a "relative" in difficulty, from a number you do not have saved, asking for money urgently. Verify on a number you already have before you send anything.
• A delivery company, a bank, or a government body demanding payment by transfer. None of them collect payment this way.
• A charity asking for donations by transfer to a personal account.

The patterns to refuse

• Ads, sponsored posts and search results promising a better rate than any real provider, or a guaranteed arrival time.
• "Claim your transfer" or "unclaimed funds waiting" messages - this is the oldest transfer fraud there is.
• A link asking you to sign in "to avoid losing access". The sign-in page is the product.
• Anything shortened so you cannot see the destination. Do not hover, do not long-press - just do not click.
• A pop-up on a site you are already using, claiming to be from QuestPay. We do not inject anything into other sites.

A habit that stops nearly all of it

• Never use a link from a message to reach your bank or your transfer account.
• Open the app or type the address yourself.
• If a message creates urgency and asks for money or credentials, stop and check through a channel you chose, not the one the message gave you.

Safer alternatives

• Use your phone's own mobile data. It is a direct connection to your carrier, not a shared network.
• Use a trusted home or work network.
• If you have to use public Wi-Fi, use a trusted VPN, and never leave the session unattended.
• Do not do it on a shared or borrowed device.

Speed matters more than perfect proof

If a transfer has just gone out and was not yours, contact us immediately. Money that has not yet been collected is far more likely to be stopped. Every hour counts.