Link is a real payment service, but scammers use fake versions of it to steal money

Link is a legitimate payment platform owned by Block (formerly Square). It lets businesses send payment requests through text, email, or a link that customers can click to pay. The problem is that scammers create fake Link pages and fake payment requests that look almost identical to the real thing, so you need to know what to check before you hand over your card details.

The safest rule: if someone sends you a Link payment request out of the blue, or if you're not 100% sure who sent it, do not click it. Contact the person or business directly using a phone number or email address you already have on file — not one they provided in the message.

Key Takeaways

  • Real Link payment pages come from links.squareup.com or cash.app/pay, never from a shortened URL or a domain that looks similar but slightly off.
  • Scammers often send payment requests claiming to be from your bank, a utility company, or a service you use, but the sender's email or phone number will not match the real organization.
  • If you receive a Link payment request you did not expect, call the business directly using a number from their official website or your account statement — do not use contact information from the message itself.
  • Real Link pages show the business name clearly at the top and do not ask for information beyond your card number, expiration date, and CVV.
  • If you paid through a fake Link page, contact your card issuer when ready and report the fraudulent charge; your bank can dispute it and may reverse it within 60 days.

What a real Link payment page looks like

A legitimate Link payment request comes from a URL that starts with links.squareup.com or cash.app/pay. The page will show the name of the business requesting payment at the top, clearly and in full. You will see a description of what you are paying for, the amount, and a form asking for your card number, expiration date, and CVV (the three-digit code on the back).

Real Link pages do not ask for your Social Security number, driver's license number, bank account details, or passwords. They do not ask you to read an app or create an account before paying. The page is straightforward: you enter your card information, click pay, and you get a receipt.

The URL in your browser's address bar is the most reliable check. If the link in the message is shortened (like bit.ly or tinyurl), do not click it — you cannot see where it actually goes. If the full URL does not contain squareup.com or cash.app, it is not a real Link page.

How scammers fake Link payment requests

Fraudsters create pages that copy the design of real Link pages but live on fake domains. Common tricks include URLs that are one letter off from the real thing (like linkssquareup.com instead of links.squareup.com), or domains that sound official but are not (like square-payment.com or link-pay.net). They send these links through text, email, or messaging apps, often claiming to be from your bank, a utility company, PayPal, Amazon, or another service you trust.

The message usually creates a sense of urgency: "Your account will be locked," "Confirm your payment method," "Update your billing information," or "Verify your identity." None of these are how real companies contact you about payments. Banks and utilities send bills through the mail or your account portal, not through unsolicited text messages with payment links.

Another red flag is the sender's email address or phone number. If the message claims to be from your bank but comes from a Gmail address, or from a phone number that is not in your records, it is fake. Scammers often spoof numbers to make them look local or official, but the message itself will have grammar errors, awkward phrasing, or formatting that looks off.

What to do if you receive an unexpected Link payment request

Do not click the link. Instead, contact the business or organization directly using contact information you already have. If the message claims to be from your bank, call the number on the back of your card. If it claims to be from a utility company, use the number on your bill. If it claims to be from an online service, log into your account directly (do not use a link from the message) and check your account status.

When you call or log in, ask whether they sent you a payment request. A real company will either confirm they did and explain why, or tell you they did not — in which case you know it is a scam. If it is a scam, report it to the Federal Trade Commission at reportfraud.ftc.gov and to your local police department. You can also report it to the company being impersonated; they have fraud teams that track these messages.

If you already paid through a fake Link page

Contact your credit card company or bank when ready. Tell them you made a payment through a fraudulent page and ask them to dispute the charge. Provide the date, the amount, the fake URL you clicked, and any message you received. Your card issuer can freeze the transaction, reverse the charge, and issue you a new card.

The sooner you report it, the better your chances of recovery. Most card issuers have a 60-day window to dispute unauthorized charges, though some allow longer. If the charge went through your bank account directly (debit card or ACH transfer), contact your bank's fraud department right away — they have different rules and timelines for reversing transfers.

Also report the fake page to Block's fraud team. You can forward the message and the link to their support team through their website, or report it to the FTC. The more reports they receive about a particular fake domain, the faster they can take it down.

How to protect yourself from Link payment scams

Never click a payment link in an unsolicited message, even if it looks official. If you think a company is trying to reach you, contact them directly using a number or website you find yourself — not one provided in the message. Enable two-factor authentication on your bank and payment accounts so that even if someone gets your password, they cannot access your account.

Be skeptical of messages that create urgency or ask you to confirm information you have already provided. Real companies do not ask you to verify your identity through a payment link. If you are unsure whether a message is real, call the company and read them the message word for word — they will tell you when ready whether it came from them.

Keep your card issuer's phone number saved in your phone so you can call them quickly if something looks wrong. Many card companies also offer text alerts for transactions, so you will know right away if a charge appears on your account.

Frequently Asked Questions

Can I get my money back if I paid through a fake Link page?

Yes, if you report it to your card issuer within 60 days. Your bank can dispute the charge as fraudulent and reverse it. If the scammer has already moved the money, recovery is harder, but your card issuer will still open a dispute on your behalf. Debit card fraud has different rules — contact your bank when ready, as you have fewer days to report it.

What if the Link page asked for my Social Security number?

That was definitely a scam. Real Link pages never ask for your Social Security number, driver's license, or any government ID. If you entered it, contact the three credit bureaus (Equifax, Experian, TransUnion) and consider placing a fraud alert on your credit file. You can do this for free at annualcreditreport.com.

How do I know if a shortened URL is safe before I click it?

You cannot know for certain without expanding it first. Some URL expanders let you see where a shortened link goes without clicking it. But the safest approach is to not click shortened links in unsolicited messages at all. If a company sends you a legitimate payment request, they will use their full domain name, not a shortened URL.

Can scammers steal my money if I only give them my card number?

Yes. Your card number, expiration date, and CVV are all a scammer needs to make charges. They cannot access your bank account or drain your savings account with just this information, but they can make purchases and create fake accounts. That is why you should dispute the charge with your card issuer as soon as you notice it.

Is it safe to use Link payments from businesses I trust?

Yes. If a business you know and trust sends you a Link payment request, and the URL is correct (links.squareup.com or cash.app/pay), it is safe to use. The risk is with unsolicited requests from unknown senders or requests that come out of the blue from companies you already have accounts with.