Scam watch: the fake Stripe email that wants your selfie and ID

A fake email from "Stripe Account Services" is doing the rounds, with the subject "Action required — Upload a photo ID to verify your account". At first glance it looks exactly like a real Stripe email: the same clean layout, the same colours, even Stripe's real office address in the footer.

It is a fake, and one small slip gives it away.

What the email looks like

The email says "Verification Pending" and that one more step is needed before full account access can be switched on. A task card asks the reader to verify the account representative "with a selfie and identity document", marked in red as "Priority: Past due". Underneath, a "Why it matters" note says payments can continue but money will not be paid out to the bank account until verification is done. Then comes a big "Verify now" button.

At the bottom, it says the request is linked to "your Northwind Co Stripe account", a business name that has nothing to do with whoever is reading it.

The random name trick

Hidden inside the email is a small script with two lists of words: first words such as Northwind, Summit, Harbor and Cedar, and second words such as Co, Labs, Store and Supply. It is meant to glue two of them together into a made-up business name, so that each copy of the email looks slightly different and slightly personal.

Email apps do not run scripts, so the trick fails and the placeholder name "Northwind Co" shows instead. The template also still contains leftover notes from whoever built it. Both point to the same thing: this is a ready-made scam kit, copied from a real Stripe email and sent to a long list of businesses, whether they use Stripe or not.

How the people behind it likely operate

• A free email account in disguise. The email is sent from a free personal webmail address, with its display name set to "Stripe Account Services". Because it goes through a large, well-known email provider, it passes the basic checks that mail systems run. Those checks prove which service sent an email, not who is behind it, so "it passed the checks" never means "it is genuine".
• A throwaway link. The "Verify now" button does not point to stripe.com. It points to a storage space with a random name on a large cloud provider. These are cheap to set up, quick to replace when reported, and the well-known cloud name in the address can help them slip past filters.
• Volume. A kit, a list of business email addresses and a little patience. Most people ignore it; a few click.

What it is after

Two things, and both are worth a lot to criminals:

• Your Stripe sign-in. With your email and password, and sometimes a 2-step code typed into the fake page, they can try to take over your account: change the bank account your money is paid into, look at customer details or move money out.
• Your selfie and photo ID. A clear photo of your face next to your passport or driving licence is exactly what many banks and apps ask for when you open an account. In criminal hands it can be used to pass identity checks in your name.

The red flags

• The sender's address is not a Stripe address. Stripe's own help pages list the domains it uses, such as stripe.com and e.stripe.com.
• The wrong business name.
• A button that does not lead to stripe.com. Hover over it on a computer, or press and hold on a phone, to see where it really goes.
• Pressure: "Past due" in red and your money "paused".
• Any genuine verification request will also show up in your Stripe Dashboard when you sign in yourself.

How to protect yourself

• Never use a link in an email to sign in. Type stripe.com yourself and check the Dashboard for any real tasks.
• Turn on 2-step sign-in for your Stripe account and your email, ideally with an authenticator app or a security key.
• Never send a selfie or ID through a link in an email.
• Report fake Stripe emails to Stripe through the contact page on its support site, and in the UK forward them to [email protected].
• Show your team what this one looks like, especially anyone who handles payments.

If you already clicked

1. If you typed your password: go to stripe.com yourself, change it, and change it anywhere else you used it. Turn on 2-step sign-in, then check your team members, your payout bank account and recent payouts and refunds. Contact Stripe support.
2. If you uploaded a selfie or ID: report it at reportfraud.police.uk (or to Police Scotland), tell your bank, and keep an eye on your credit report. In the UK you can also ask Cifas for Protective Registration, which flags your name so lenders do extra checks.
3. Tell people quickly. The sooner Stripe, your bank and your team know, the less damage a stolen login or ID can do.

Real requests from Stripe live in your Dashboard. If an email wants your face and your passport in a hurry, close it and sign in the long way.