Are payment links safe? What to check before paying for transport

Are payment links safe? A payment link is only as safe as what it proves. The link itself is just an address; what matters is whether that address, the page it opens and the details printed on it all trace back to the company you booked with. For a Pakistan journey arranged from abroad, you can check that in under a minute: the address should start on idrive.pk and hand over to a card page on Stripe’s own checkout domain; the page should name your booking reference; the amount should match the rupee figure you were quoted; and nothing should ask you to wire money to a personal account instead. If any one of those fails, do not pay. Contact the company through the website you found yourself, not through the message that carried the link.

“Look for the padlock” is no longer enough: scam pages carry padlocks too. What they rarely carry is a correct reference, the correct fare and a payee that matches the brand.

The decision in one table

Use this as a pass/fail sheet. Every row should pass before you enter card details.

Why a fake payment link scam works on travellers

A fake payment link scam does not need to hack anything. It needs timing. Overseas travellers are expecting a payment request: they have just asked for a quote, they are juggling time zones, and they are often paying for relatives who will ride in the car. A message with the right city names, arriving at the right moment, feels legitimate before it has proved anything.

The UK’s National Cyber Security Centre lists five tell-tale signs that scam messages lean on: authority, urgency, emotion, scarcity and current events. Under the last of those, its guidance on how to spot a scam email, text message or call asks a question that cuts sharply for travel bookings: are you expecting to see a message like this? A criminal who knows you are waiting for a link only has to send one, which is why the moment you expect a payment request is the moment to slow down.

Transport bookings add two extra weaknesses:

• Many people in the chain. A booker in Birmingham, a passenger in Lahore, a driver, an operator. A stranger claiming to be “the driver” or “the office” is hard to disprove on the spot.
• Real deadlines. A flight lands at a fixed time. “Pay now or lose the car” lands on a nerve that is already exposed.

How to check a payment link before paying: the address

Start with the one field a scammer cannot fully control: the domain. To check a payment link before paying, do not trust the blue text in the message. Long-press it on a phone, or hover over it on a laptop, and read the real destination. Then open it and read the browser bar again, because redirects can take you somewhere different from where the link appeared to point.

What a genuine iDrive payment path looks like

1. It begins on idrive.pk. The pay page is part of the booking area of the site, the same site you booked on. Its address starts https://idrive.pk/, with nothing between “idrive” and “.pk” and nothing before “idrive” except “https://”. iDrive’s secure checkout page sits on the same domain.
2. The card form is hosted by Stripe. When you press the pay button, the card details are taken on a Stripe-hosted checkout page. Stripe’s own documentation for merchants names its default checkout address as checkout.stripe.com. That handover is expected; a card form on an unrelated domain is not.
3. It comes back to idrive.pk. After payment you should land back on idrive.pk with a paid confirmation for the same reference, and a receipt should follow by email.

What a secure checkout URL is not

A secure checkout URL is not just an address with “https” and a padlock. Those only mean the connection is encrypted; a criminal’s site can be encrypted too. Watch for:

• Spellings that are close but wrong: an extra letter, a hyphen, a swapped vowel, “idrive” followed by “-pk” or “.com” instead of “.pk”.
• The brand name buried inside someone else’s domain, such as a subdomain in front of an unrelated site.
• Free form builders, file-sharing pages or chat links presented as “the booking system”.
• A QR code in a message that opens a payment page you cannot trace back to the website.

If unsure, ignore the link. Type idrive.pk yourself, sign in to your iDrive customer account and see what the booking says about payment. A genuine request can be reached without the message; a fake one cannot.

Reference, amount and currency: what the page itself must show

Once the address passes, read the page as if you were checking an invoice, because that is what it is.

The booking reference

Every iDrive booking has a reference that begins with IDR-, followed by a date code and a short string (for example, a reference in the format IDR-260920-XXXX; yours will differ). That reference should appear on the pay page, in the booking email that carried the link, and on the checkout line item. If the three do not agree, stop. A payment request with no reference, or one that describes your trip only as “taxi booking”, has not proved it belongs to you.

The journey

The pay page should restate what you booked: pick-up, drop-off, date, time and vehicle, with each part of a combined basket listed separately. Check the dates. A request for “your return journey” that you never booked is a classic hook.

The amount, in rupees first

iDrive prices journeys in Pakistani rupees. The rupee amount on the pay page should be exactly the figure shown when you booked, and the same figure as in your booking email. If you have changed the journey since booking (a new pick-up time, an added stop, a bigger vehicle), the amount may legitimately change, but that change should reach you through the booking itself, not through a new number on WhatsApp. When two different amounts are floating around, ask which is current before paying anything.

Paying in pounds, dollars or dirhams

You can choose to pay in another currency, such as GBP, USD, EUR, AED or SAR. When you do, the page shows the converted amount alongside the rupee fare it came from, converted at a reference rate on the day, and the checkout line keeps the rupee base in its description. That gives you something concrete to compare. A genuine converted figure is explained; a scam figure usually just appears, often rounded to a suspiciously neat number in a currency you did not pick.

Your own bank may add a foreign-transaction fee on top. That is set by your card issuer, not by the merchant, so check your card’s terms if the difference matters.

Who gets the money: the payee and your card statement

The last identity check happens after you pay, and it is the one people skip. Look at who the money went to.

• On the checkout page, the merchant name is shown at the top. It should name the brand you booked with. A checkout carrying a private individual’s name, or a company you have never heard of, is not a payment to your transport provider, whatever the message said.
• On your card statement, the line should reference the same brand. Banks and card apps sometimes shorten or reformat merchant names, so an abbreviated version is normal; a completely different business is not.
• In your inbox, a payment confirmation should arrive for the same reference and amount. For iDrive bookings a downloadable receipt is offered once the payment has gone through.

If a charge appears that you cannot match to a booking, contact the merchant with the reference first, then your card issuer. Do both quickly; card disputes have time limits set by your bank.

The WhatsApp payment link booking scam, step by step

The WhatsApp payment link booking scam is worth describing on its own, because it is how most overseas Pakistanis actually coordinate travel, and scammers know it. A typical pattern looks like this (a composite example, not a specific incident):

1. You enquire about an airport pick-up on a public page or in a community group.
2. Within minutes, a number you do not know messages you with a friendly greeting, your arrival city and a quote.
3. A link follows, or a request to “confirm the booking” by sending a deposit to a bank account or mobile wallet.
4. The pressure starts: limited cars, peak season, “the driver is waiting for confirmation”.
5. After payment, the number goes quiet or asks for more money for “tolls” or “insurance”.

The NCSC’s answer to this pattern is blunt: if you have any doubt, contact the organisation directly, and do not use the numbers or address in the message; use the details on its official website. GOV.UK’s page on reporting internet scams and phishing adds the practical bit: do not click links you are unsure of, forward suspicious emails to report@phishing.gov.uk, and forward suspicious text messages free to 7726.

Two habits defeat this pattern almost entirely. First, start every booking on the brand’s own website so that your reference, quote and payment request exist in one place you control. Second, treat any payment request that arrives by chat as a prompt to go and check, never as the thing you pay. If you want to confirm a message is really from iDrive, write through the iDrive contact page and quote your reference.

Red flags that should stop you paying

Any single item below is enough to pause. Two together is enough to walk away.

• A request to pay by bank transfer or mobile wallet to an individual. Transfers are hard to reverse and lack card protections. Verify any such request through the website before anything moves.
• “The driver will take the fare, but send the advance to me.” Split instructions from different people are how money disappears between them.
• A change of payee mid-conversation. “Our account has a problem, use this one instead” is the oldest trick in invoice fraud.
• Urgency without a reason. Genuine operators give you time to read a page. Ultimatums measured in minutes are a tactic.
• A price well below everything else you have seen. It is designed to make you act before you think.
• Requests for one-time passcodes or card PINs. A merchant has no reason to ask for your OTP or PIN over chat or a call. The code your bank sends is for you to enter on the checkout page, and nowhere else.
• A link sent to the passenger, not the booker. A passenger who did not make the booking, often an older relative, has no way to check it on the spot.
• A screenshot of a “confirmation” instead of an email. Screenshots are trivially edited.

Already paid a suspicious link? Do this in order

Speed matters more than embarrassment. The sooner your bank knows, the better its chance of stopping or tracing the payment.

1. Call your bank or card issuer on the number printed on your card or in its app. Not a number from the message. Tell them you have paid a suspected scam and ask them to block the card if you entered card details. The NCSC’s guidance on what to do if you have shared details with a scammer is the same for banking details and for lost money: tell your bank.
2. Stop all further payments. Scammers often come back for a second amount as a “refund fee” or “release charge”. Refunds never require you to pay first.
3. Keep the evidence. Screenshot the chat, the link, the phone number, the payment page and the transaction. Do not delete the conversation before you have reported it.
4. Report it where you live. In England, Wales and Northern Ireland, report to Report Fraud, online or on 0300 123 2040, the number GOV.UK gives for it. In Scotland, report the crime to Police Scotland, whose non-emergency number is 101. Elsewhere, use your national police fraud channel.
5. If money left a Pakistani bank or wallet, call that bank or wallet provider first, on the helpline in its own app or website. For a complaint to the authorities, the Federal Investigation Agency website links to an online complaint portal and an Overseas Pakistani complaint cell, and lists helplines 051-111-345-786 and 1991.
6. Change passwords if you typed a login anywhere, starting with your email, because email is how most accounts are reset.
7. Tell the real company. If the scam used a brand’s name, the brand needs to know so it can warn other customers. Include the number or link the message came from.

Then sort out the journey itself. If you still need the car, book it again from the website you typed in yourself, and check the new booking in your account before paying anything.

Paying for someone else’s journey

Plenty of Pakistan journeys are booked by one person for another: a son in Leeds booking his parents’ ride from Islamabad airport to Mirpur, a daughter in Dubai sorting a wedding day in Lahore. That split is exactly what scammers exploit, so agree a few rules within the family before anyone travels:

• The booker pays. The passenger never pays a link or transfer they receive directly, however convincing it looks.
• The passenger knows the booking reference and who the booker is, so they can say “please speak to my son” and end the call.
• Any request for extra money on the day goes back to the booker, who checks it against the booking.

Our sister service Pakistan Taxi has a practical guide to booking and paying for someone else’s airport ride that covers the passenger-side details. And if your family also travels for Umrah, our sister company Hajj Umrah Taxi explains what a Saudi transport booking confirmation should include, which pairs well with the payment checks here.

What iDrive will and will not do

So that you have a fixed point to compare any message against:

• Payment requests relate to a booking you can see. You can open it from your account or from the booking email, and the reference, journey and amount will be on it.
• A broken pay link is fixed through the booking. If a link stops working, open the booking from your account or ask iDrive for a fresh link against your reference, rather than using one sent by anyone else.
• Refunds come from iDrive to the card you paid with. Under the iDrive refund policy, a refund is issued by iDrive against the original payment, not by the driver or the partner company, and you will not be asked for new card or bank details to receive it. Nobody should ask you to pay anything first.
• Nobody from iDrive needs your card PIN or bank passcode. If someone asks, it is not us.

If you are planning a trip now, start the journey on idrive.pk so your reference, quote and any payment request live in one place you control. Availability and the final vehicle depend on the booking being accepted, and you will see its status in your account.

Questions people ask

Is a link safe just because it shows a padlock?

No. The padlock means the connection is encrypted, not that the site belongs to who it claims. Check the domain, the booking reference, the amount and the payee as well.

Why does the iDrive payment page move to a Stripe address?

Card details are taken on Stripe’s hosted checkout, whose default address is checkout.stripe.com. You start on idrive.pk, pay on Stripe’s page and return to idrive.pk with a confirmation for the same reference.

Someone on WhatsApp says they are my driver and wants an advance. What should I do?

Do not pay. Check the booking in your iDrive account and contact iDrive through the website, quoting your reference. Any payment should be tied to the booking you can see.

The amount in pounds looks different from what I expected. Is that a scam?

Not necessarily. Fares are set in rupees; a pound, dollar or dirham figure is converted from that rupee base on the day and is shown next to it. If the rupee figure itself differs from your booking, stop and ask.

I paid a fake link with my card. Can I get the money back?

Call your card issuer straight away using the number on your card; they can block the card and advise on a dispute. Then report it to Report Fraud (or Police Scotland), keeping screenshots as evidence.