Impersonation attempts (phishing) imitate the emails and websites of payment companies to steal credentials or money. Knowing how to tell an official Conekta communication from a fake one is the simplest and most effective defense for your account.
Official domains and channels
- Emails: they come from addresses ending in the official domains conekta.com or conekta.io. Check the full sender address, not just the display name.
- Conekta Panel: the only address for logging in is panel.conekta.com. Type it directly into your browser instead of following links.
- Service status: incidents are posted at status.conekta.io.
What Conekta will never ask you for
- Your password or your two-step verification code, through any channel.
- Your full private API keys.
- A bank transfer, deposit, or payment to "unlock" your account or "release" a payout.
- Full card details, whether yours or your customers'.
- To install remote access software on your computer.
Warning signs
- Artificial urgency: "your account will be suspended today" is meant to make you act without thinking.
- Look-alike domains: variations of the name conekta with swapped letters, hyphens, or unusual endings.
- Mismatched links: the text says one thing and the actual destination is another; check before you click.
- Unexpected attachments: invoices or receipts you didn't request.
- Writing errors: sloppy spelling or generic greetings on a sensitive topic.
What to do if you receive a suspicious message
Report it so Conekta can act against the campaign: follow How to report a fraudulent email, website, or message. And if you entered your credentials on a fake site, act immediately with What to do if I suspect someone accessed my account.