Taking payment where the conversation already is removes real friction. It also puts your business in the exact shape that payment fraud imitates, so the details matter more than usual.
Never ask for these in chat
Card numbers, CVV, expiry, net-banking passwords, UPI PIN, or an OTP. Not in any circumstance, not "just the last four to verify", not because the customer offered. Message history persists on devices you do not control and in backups you cannot reach, and asking at all trains your customers to hand these to whoever asks next.
If a customer sends card details unprompted, delete the message, tell them why, and send a proper payment link. The instinct to be accommodating is wrong here.
What good looks like
- Confirm the order and the amount in the chat, in plain text, so there is a record both sides can read.
- Send a payment link generated by your payment provider, unique to this order.
- The link opens the provider's own hosted page, on a domain the customer can recognise.
- They pay there. Nothing sensitive touches the conversation.
- Your system confirms receipt and you send a Utility confirmation with the order reference.
Make the link verifiable
Payment fraud over messaging is common enough that customers are right to be wary. Help them be confident:
- Use a consistent domain, ideally your own or your provider's well-known one — never a URL shortener.
- State the exact amount in the message, so a tampered link is obvious.
- Include the order reference.
- Give the link a short expiry.
- Tell customers, in advance, how your payment requests always look. Predictability is the best anti-fraud tool you have.
Expect impersonation
If you sell over WhatsApp, someone will eventually impersonate you to your customers with a similar display name and a payment request. You cannot prevent it entirely, but you can reduce the damage: publish your official number prominently, state that you never ask for OTPs or PINs, and give customers an easy way to verify a message is genuinely from you.
When it happens, tell your customer base quickly and plainly. Businesses that stay quiet about impersonation take far more reputational damage than those that warn people.
Confirmations are Utility
Payment received, order confirmed, refund processed — all Utility templates, all should include the order reference and the amount. Send them promptly; the gap between paying and being confirmed is where anxious customers open a support conversation.
Refunds and disputes
Keep refund conversations in the same thread as the original order so the whole history sits together. Confirm the amount, the method and the expected timeline in writing, then send the Utility confirmation when it is actually processed. Most refund complaints are not about the money but about not knowing where it is.
Records
Chat is not an accounting system. Every payment should exist in your provider's records and your books, with the conversation as supporting context rather than the source of truth. Teams that reconcile from chat transcripts discover the problem at the worst possible time, which is an audit.