Using payment links safely on WhatsApp
Photo: Avila Ops Tecnologia
A WhatsApp payment link is safe when four things match: it arrives in the existing conversation, from the number the customer already knows, points to your domain or a known processor (Mercado Pago, PagSeguro, Stripe, the bank), and the amount on screen matches the amount agreed in the previous message. If any one fails, the customer is right to be suspicious, and you are right to fix it before sending.
Fake-link scams are common, and customers have learned to be cautious. The same caution that protects them from scams makes them hesitate over your legitimate link. Your job is to make the link recognizable, not just functional. Send it right after “it’s a deal,” as shown in WhatsApp quotes without turning into an auction.
What does the customer check before clicking?
Put yourself in their place. They receive a link and evaluate it in two seconds:
| What they see | Trust signal | Scam signal |
|---|---|---|
| Sending number | The same one throughout the conversation, with a business account badge and company name | A new number “from finance,” without a photo |
| Link address | suaempresa.com.br/pagar or mpago.la, pag.ae, a bank link | Unknown shortener, similar but different domain, random string |
| Amount | Matches the agreement, with a description of what is being paid for | Different amount, or a request for an extra “fee” |
| Payment page | Company name, CNPJ, order description, browser padlock | Generic form asking for a bank password or security code by message |
| Context | Follows a conversation with an accepted quote | Arrives out of nowhere, with urgency |
The number row is the most important and most forgotten. If payment comes from a second number, the customer is suspicious, rightly so: that is exactly how the scam works. If you changed numbers, notify them through the old conversation first, as explained at avilaops.com/guias/como-trocar-o-numero-do-whatsapp-business-da-empresa.
How do you send the link correctly?
- Confirm the order in the message before the link: what it is, how much it costs, and when it will be delivered.
- Send the link in the next message, with the amount beside it: “Link to pay the R$ 4,800 for the cabinet: [link]. You can pay by Pix, card, or boleto.”
- Explain where the link comes from: “The link is from Mercado Pago, under [legal business name]” or “it opens on our website, suaempresa.com.br.”
- Use one link per order with a fixed amount. A generic link where customers enter the amount creates room for errors and suspicion.
- Say you will confirm: “As soon as it arrives, I’ll send confirmation here.” Then send it.
- Never ask for a code, password, or photo of the card by message. If the customer has trouble, advise them to call the bank rather than send details to you.
For Pix payments, the alternative to a link is a QR code or key. The key should be the company’s CNPJ, not the owner’s CPF. The customer sees the company’s name in the bank confirmation, completing the picture.
What should you do on your side to avoid becoming a victim?
Scams also target businesses: fake Pix receipts, refunds forced by the bank (chargebacks) after delivery, customers who claim they paid but did not.
- Only release an order after seeing the money in your account or the processor’s dashboard, not based on the receipt the customer sent. Pix arrives immediately; if it has not arrived, it has not been paid.
- A boleto clears within three business days. Do not deliver before then.
- For card payments, keep the conversation with the order and delivery confirmation. It is your defense in a dispute.
- Enable two-step verification in WhatsApp Business. A cloned account sending fake links to your customers is the worst scenario, and verification prevents most cases.
- For businesses collecting every month, recurring billing takes the link out of the conversation and reduces the chance of error. What it is and when it makes sense is explained at https://avilaops.com/guias/o-que-e-cobranca-recorrente/.
What to do now
Open the last payment link you sent and check the four points: number, address, amount, page. If the link uses a shortener or the Pix is under a CPF, correct it before the next order. E-Commerce generates a link per order on your domain, with instant Pix, cards, and boleto and no sales commission: avilaops.com/loja-virtual or contact us on WhatsApp: wa.me/5517997811471.
Frequently asked questions
Is a Mercado Pago or PagSeguro payment link safe?
Yes, and customers usually recognize the domains. Safety depends on how it arrives: in the right conversation, from the right number, with the right amount. The processor protects the transaction; the context protects trust.
Can I send the payment link before the customer confirms?
No. A link arriving before “yes” looks like pressure and, to a suspicious customer, like a scam. Confirm the order, receive acceptance, send the link. Three messages, in that order.
The customer paid by Pix and requested a refund. What now?
Pix has the Special Refund Mechanism (MED) for scams and fraud, initiated by the customer’s bank. For a change of mind about a purchase, Brazil’s Consumer Protection Code applies: a seven-day withdrawal period for purchases outside a physical store, counted from receiving the product or contracting the service. Keep the order and delivery recorded in the conversation so you can respond to the bank if necessary.
Turn what you learned into your next step.
Tell us about your company and what you want to improve. We can explore the right tools, integrations or custom project together.