Recognising scams and fraud: a guide for shop owners

Running your shop through Bike Reservation Manager means handling bookings, payments and customer data — which unfortunately makes you a target for scammers who impersonate us, your payment provider, or your own customers. Below are the scams we see most often and how to handle them.

The golden rule: neither Bike Reservation Manager nor Stripe will ever cold-call or email you demanding an urgent payment, a password, a 2FA code, or remote access to your computer. If a message creates panic and pressure to act right now, treat it as a scam until you’ve verified it independently.

Someone called to say my business isn’t PCI compliant and I need to pay a fee. Is this real?

No — this is a common scam. All card payments in Bike Reservation Manager are processed by Stripe, a certified Level 1 PCI Service Provider (the highest level). Raw card numbers never touch your computer or our software, so there’s no separate compliance fee for you to pay and no certificate to buy from a cold-caller. We will never phone to demand a PCI payment. If you want to confirm your payment setup is healthy, log in to your Stripe Dashboard directly rather than acting on an inbound call.

I got an email or text asking me to “verify” or “reactivate” my account. Should I click the link?

No. Phishing messages copy our branding (or Stripe’s) and warn that your account is suspended or a payment failed, linking to a fake login page that steals your details. Check the sender’s real address and hover over links before clicking — watch for lookalike domains (extra words, .net instead of the real address, misspellings). We’ll only ever ask you to log in at your usual Bike Reservation Manager web address, so type it in yourself rather than clicking. Generic greetings, spelling errors and urgent threats are all red flags. If in doubt, don’t click — contact us through the in-app support channel and we’ll confirm whether it’s genuine.

A support agent called asking for my password, a code, or remote access. Is that normal?

No. It's very unlikely our support would contact you unprompted and ask for your password, ask for a two-factor/verification code, or ask to remote-control your computer to “fix billing.” Scammers use this to take over your account. Hang up and contact us through the official support channel to check whether anyone actually needed you.

I received an email asking me to update my payout or bank details. Should I?

Not from an email. Payout details are managed only inside your Stripe Dashboard. A request to change your bank details — even one that looks like it’s from us, Stripe, or your own team — is a common way to redirect your money. Never change payout details based on an email or phone request; log in to Stripe directly to review them, and turn on two-factor authentication on your Stripe account.

A customer overpaid and is asking me to refund the difference. What should I do?

Be very cautious. A common scam is to appear to overpay (or pay then cancel) and pressure you to refund the difference — the original payment is later reversed or was made with a stolen card, leaving you out of pocket. Only ever refund the original payment, through the original booking in Bike Reservation Manager. Never send money back by a different method, to a different card, or by bank transfer, and be wary of anyone in a hurry to get a partial refund.

I’m seeing suspicious bookings or lots of failed payment attempts. What’s going on?

This can be “card testing,” where fraudsters use your booking form to try stolen card numbers, or real bookings placed on stolen cards that later become chargebacks. Warning signs include a burst of failed payments, mismatched names and emails, or unusually large or last-minute bookings from new customers. Don’t rush to fulfil a booking that feels off. Stripe’s built-in fraud protection (Radar) blocks many of these automatically and lets you review flagged payments in your dashboard — and you can always flag unusual patterns to us to review together.

I got an invoice for my subscription or a “renewal.” How do I know if it’s genuine?

Fake invoices claim your Bike Reservation Manager subscription is overdue, or come from unrelated third parties (“directory listing,” “SEO,” “domain renewal”) dressed up to look official. Compare anything against your real billing — your genuine charges appear in your account. We’ll never threaten to cut off your shop over an invoice sent from an unfamiliar address. When in doubt, check with us before paying.

One of my customers got a scam text about their booking. What should I tell them?

Sometimes it’s your customers who are targeted — a text or email posing as your shop asking them to “confirm payment” via a dodgy link. Reassure them that genuine booking confirmations come through your normal Bike Reservation Manager notifications. Encourage them not to click payment links in unexpected texts and to contact your shop directly if they’re unsure.

What will Bike Reservation Manager never do?

• Cold-call demanding an urgent payment or PCI fee
• Ask for your password or a 2FA code
• Ask to remote-control your computer to fix billing
• Ask you to change payout details by email
• Threaten to shut down your shop within minutes unless you pay

I think I’ve been targeted — what should I do?

1. Don’t pay, click, or share anything until you’ve verified independently.
2. If you entered your password on a suspicious site, contact us to change it immediately and enable two-factor authentication.
3. For anything payment-related, log in to Stripe directly to check your account and payouts.
4. Contact our support team through the in-app channel and forward the suspicious message so we can warn other shops.
5. Report financial fraud to your local authority (in the UK, Action Fraud; elsewhere, your national fraud reporting service) and to your bank if money has moved.
   
   

When in doubt, stop and check with us first — we’d always rather answer an “is this real?” question than help you recover afterwards.