Clients trust a payment request when they were expecting it, it comes from a name and address they recognise, and the link opens a page showing your business and an invoice they know about. Tell clients in advance how you'll ask for payment, send from your own email address where you can, and never ask for card or bank details in an email.
In this article
The short version
- Genuine payment requests can look like phishing when they're unexpected or come from an unfamiliar address.
- Tell clients before the first request arrives, from your usual email address.
- Sending from your own domain, set up with SPF, DKIM and DMARC, removes a common doubt.
- A genuine link opens a page showing your business and invoice, and never asks for details by email.
- If a client suspects fraud, confirm by phone and thank them for checking.
Why genuine requests get mistaken for scams
Your clients have been told for years to be wary of emails asking for money, and they're right to be. Fake invoices and changed bank details are among the most common ways businesses lose money, so a careful finance team treats any unexpected payment email with suspicion.
A genuine request can tick several of the boxes they've been trained to look for. It might come from an address they haven't seen before, often the payment provider's rather than yours. It contains a link and asks them to pay. And if it's the first time you've used payment links or direct debit, it doesn't look like your usual invoice. None of that makes it fraudulent, but it's enough for a client to ignore it, forward it to their IT team or ring you to check.
You wouldn't want clients to be less cautious. You can make your real requests predictable, so they look the same every time and match what you told clients to expect.
Tell clients before the first request arrives
Start with a short message before you change how you ask for payment. Send it from your usual email address, ideally from the person the client already deals with, a week or so before the first request goes out. It should say what's changing, what the new emails will look like, and what you'll never ask for.
Here's wording you can adapt:
Hi [name],
From [date], your invoices from [business name] will arrive with a link to pay online by card, Apple Pay, Google Pay or pay by bank. The email will show [business name] as the sender and will include your invoice number and amount.
The link opens a secure payment page with your invoice on it. We'll never ask you to send card details or bank details by email, and our bank details won't change without us telling you by phone first.
If anything about a payment request looks wrong, call me on [number you already have on file] before paying.
Thanks,[your name]
If you're moving clients onto direct debit, add a line saying they'll be asked to set up a mandate and will get notice of the amount and date before each collection. Clients who know a mandate request is coming tend to be more likely to complete it.
Send from an address your clients know
The sender line is the first thing a client sees, and an unfamiliar address is the easiest reason to distrust an email. Many invoicing and payment tools send from their own address by default, with your business name shown as the sender. That's genuine, but it can look odd to someone who has only ever had emails from you.
Sending from your own domain removes that doubt. It also needs your email set up properly, so that receiving systems can confirm the message really came from you. The National Cyber Security Centre recommends that organisations publish SPF, DKIM and DMARC records for their domains, and any service that sends email in your name needs to be included. If you're not sure whether that's in place, ask whoever runs your email.
In Adfin, payment requests and reminders show your business name as the sender, and on Enhanced credit control, which costs 0.3% of a paid invoice only where it's used, you can connect your Gmail or Outlook account and send from your own address. Replies then land with a person the client already knows, which tends to settle a doubtful client faster than any explanation.
What a genuine payment request looks like
It helps to tell clients, in your heads-up email or on your invoice, what to look for. A genuine request from you should:
- name your business as the sender and refer to an invoice number and amount the client recognises
- link to a payment page that shows your business name and the invoice, and asks for card or bank details only on that page
- never ask the client to reply with card numbers, bank details or passwords
- never tell them your bank details have changed, unless you've already spoken to them
- come from a provider that's authorised to handle payments, which clients can check on the FCA register
Payment links and direct debit also mean clients don't have to copy bank details from an invoice, and those are the details a fraudster would most want to change. With Adfin, clients pay through a page showing your invoice, card payments are processed through regulated partners, and every request and reminder follows the same format, so clients get used to one consistent look. Adfin's collection agents send reminders within rules you approve, and you can pause chasing for a client who's querying a request while you sort it out.
If a client does think a request is a scam, thank them for checking. Confirm the details by phone, resend the request if they'd like, and note which part made them suspicious, because other clients may be wondering the same thing.
Related guides
- How to spot and prevent invoice fraud
- Payment links: what they are and why they get paid faster
- Why are my customers not receiving my invoice emails?
- Do payment reminders get more replies when they come from your own email address?
- Taking payments in the UK: a complete guide
Common questions
Why do clients think my payment requests are scams? Usually because the email came from an unfamiliar address, contained a link and asked for money without warning. Telling clients in advance and sending from a consistent address removes most of the doubt.
Should I warn clients before switching to payment links? Yes. A short email from your usual address, saying what the new requests will look like and what you'll never ask for, makes it more likely clients will pay the first one.
Is it safe for clients to pay through a payment link? A link from a business they know, opening a payment page that shows that business and their invoice, is a normal way to pay. Clients should still call on a number they already have if anything looks different.
Can I send payment requests from my own email address? Many tools allow it once you connect your mailbox. In Adfin, sending from your own address is part of Enhanced credit control, at 0.3% of a paid invoice only where it's used.
What should I do if a client won't pay a link because they think it's fraud? Confirm the request by phone, resend it if they want, and offer another way to pay if they'd still rather not use the link.
Do SPF, DKIM and DMARC matter for invoice emails? They help receiving email systems confirm a message came from your domain, which makes it less likely to be marked as spam or spoofed.
Sources
- National Cyber Security Centre - Phishing attacks: defending your organisation (accurate as of November 2026) https://www.ncsc.gov.uk/guidance/phishing
- National Cyber Security Centre - Email security and anti-spoofing (accurate as of November 2026) https://www.ncsc.gov.uk/collection/email-security-and-anti-spoofing
- FCA - Financial Services Register (accurate as of November 2026) https://register.fca.org.uk/
- Adfin - Pricing (accurate as of November 2026) https://www.adfin.com/pricing
