Wompi is the payment gateway owned by Bancolombia, used by tens of thousands of Colombian businesses. The scam that rides its name doesn't target shoppers — it targets sellers. A "buyer" sends a convincing fake payment confirmation (a "comprobante" or transfer screenshot), often with a "the bank's just delayed, ship it now" push, so you hand over the goods before realising no money arrived. Two rules end it: a comprobante is a claim, not money — only a credit in your own account counts — and a genuine Wompi link always lives on checkout.wompi.co. Wait for the funds, check the domain, and never release anything on a promise.
If you're mid-sale and a payment "confirmation" just landed, skip to how a seller stays safe. The rest explains why this con works on careful people — because it attacks the one moment you most want the deal to be real.
The scam runs backwards
Strip a typical phishing scam down and the target is a consumer: a fake message, a moment of fear, a click on a link that harvests a login. The dominant Wompi scam inverts every part of that. There's no fear — there's hope. You listed an item, someone wants it, and the only thing standing between you and a completed sale is confirmation that they paid. That is precisely the lever the scammer pulls.
As reported by the Colombian outlet Infobae, the pattern is consistent: a buyer agrees quickly, then sends a comprobante de pago — a payment-confirmation image — that looks authentic, sometimes followed by emails styled to look like the platform's own. Then comes the line that does the real work: the money is sent, the bank is just slow, please dispatch today. You're not being asked to click anything dangerous. You're being asked to trust a picture.
Why it works: your eagerness to close
The fake-confirmation scam doesn't need you to be careless. It needs you to be motivated. Every seller wants the transaction done — the item gone, the money in. The scammer simply supplies the evidence you were already hoping to see, then adds a small, reasonable-sounding delay to buy the gap they need.
That gap is the whole scheme. A genuine Wompi or instant transfer in Colombia is effectively immediate — you'd see it in your account at once. The "it'll clear in a couple of hours" story exists for one purpose: to separate the moment you ship the goods from the moment you'd discover the money was never coming. Close that gap — refuse to act until the funds are actually in your account — and there is no scam left to run.
A comprobante is a claim, not money
This is the line to keep. A payment-confirmation screenshot, a "transfer sent" message, an emailed receipt — none of these are money. They are claims about money, made by the person who benefits if you believe them. An image can be edited, recycled from a real transaction, or built from scratch. The only thing that confirms a payment is the payment itself, visible where it would actually arrive: your own Bancolombia or Wompi account. Not the buyer's screenshot. Yours.
checkout.wompi.co/l/…). Wompi's value is borrowed trust — it's backed by Bancolombia — and the scam borrows it right back with a look-alike domain under a perfect logo. The logo is the easy part to fake. The domain is not. If it isn't exactly checkout.wompi.co, the trust is fake even when the branding is flawless.The other two Wompi cons
The fake-confirmation scam is the headline, but the Wompi and Bancolombia name gets misused in two other ways worth knowing.
Is a "Wompi" text or email phishing, or just spam?
The seller scam is the headline, but a second crowd searches the Wompi name for a different reason: an unexpected message claiming to be from Wompi has landed, and they want to know whether it's a phishing attempt, plain spam, or something real. Here's the clean answer. Wompi is a checkout gateway — you only ever meet it at the instant you pay on a shop's website. It has no direct relationship with you as a shopper, which means it has no reason to text, email, or WhatsApp you out of the blue about a payment, a refund, or your "account."
So an unsolicited "Wompi" message — confirm this payment, claim your refund, your account needs verifying, tap here — is phishing dressed in borrowed branding, and reporting it as spam is exactly the right instinct. Two tells settle it every time: it reached you unsolicited, and any link inside it is not on checkout.wompi.co. A genuine Wompi link only appears at the moment you choose to pay on a merchant's checkout — it is never pushed to you in a message first. Don't tap it; delete it. And if it's dressed as Bancolombia, hold the bank's own rule: it never asks for your username, password, card number, or codes by message, call, or email.
How a seller stays safe
You don't need to spot a perfect fake. You only need to refuse to act on anything but a real credit in your own account.
The bigger picture
Colombia is in the middle of a digital-fraud wave. According to Bloomberg Línea, the country logged more than 218,000 fraud complaints in financial channels in the first half of 2025, part of a broader rise in cybercrime reporting. Scams that wear the colours of trusted brands — Bancolombia, Wompi, the marketplaces people use daily — are effective precisely because those names have earned trust the scammer hasn't. That's the whole trick, and it's also the whole defence: trust the institution, but verify inside its app and on its domain — never through whatever a stranger sends you.
If you take one line from this, take this: a comprobante is a claim, not money — and a real Wompi link lives only on checkout.wompi.co. Wait for the funds in your own account, and the most common Wompi scam has nothing left to stand on.
Not sure if a payment is real? Let's look before you ship.
Send us the message and the "confirmation" you received. A real expert reviews every case and replies within 24 hours. Free, confidential, no pressure.
Wompi FAQ, common questions about the scam, and about Wompi itself
A buyer sent me a Wompi or Bancolombia payment confirmation. Is it real?
Treat it as unproven until the money is actually in your account. A screenshot of a 'comprobante de pago' or a transfer receipt is just an image — it can be edited, faked, or copied from a real one. The dominant Wompi-related scam in Colombia targets sellers: a 'buyer' sends a convincing payment confirmation, often with a line like 'the bank is delayed, it'll land in a couple of hours,' and pressures you to hand over or ship the item now. Don't. A real payment shows up in your own Bancolombia or Wompi account — not in a message from the person who owes you money.
How do I know if a Wompi payment link is genuine?
Check the domain. According to Wompi's own documentation, a legitimate Wompi payment link always lives on checkout.wompi.co (for example, checkout.wompi.co/l/ followed by a code). If a link claims to be Wompi but the address is anything else — a look-alike domain, a shortened link hiding the destination, or a misspelling — the trust is fake even if the Wompi or Bancolombia logo looks perfect. The logo is the easiest thing for a scammer to copy; the domain is the hard part to fake.
A buyer says the money will arrive in a few hours and wants me to ship now. Is that normal?
No — that delay line is the scam's signature move. Genuine Wompi and instant-transfer payments in Colombia are effectively immediate; you see them in your account right away. 'It's processing,' 'the bank had an error,' or 'it'll clear by tonight, just send it now' exists for one reason: to separate the moment you ship the goods from the moment you'd discover no money ever arrived. Wait for the funds to actually appear in your account before you release anything.
I sell online in Colombia. How do I protect myself?
Three habits end almost all of it. First, verify payment only inside your own Bancolombia or Wompi account — never from a screenshot, email, or message the buyer sends. Second, never ship, deliver, or hand over goods until the money has actually cleared into your account. Third, if there's any doubt, contact the payer directly and, at handover, you can ask to see identification or the card used. Wompi itself advises merchants to watch for unusual patterns — many transactions from the same payment method, or different cards registering the same address.
I got a text, email, or WhatsApp from 'Wompi' — is it phishing or spam?
Almost certainly. Wompi is a checkout gateway — you only ever meet it at the instant you pay on a shop's website. It has no direct relationship with you as a shopper, so it has no reason to text, email, or WhatsApp you out of the blue about a payment, a refund, or your 'account.' An unsolicited 'Wompi' message telling you to click a link, confirm a payment, claim a refund, or 'verify' your details is phishing wearing borrowed branding — reporting it as spam is the right instinct. Two tells settle it every time: it arrived unsolicited, and any link inside it is not on checkout.wompi.co. Don't tap it. Delete it, and report it to the Policía Nacional's CAI Virtual (caivirtual.policia.gov.co).
Does Wompi or Bancolombia send payment links or refunds by SMS or WhatsApp?
No. A genuine Wompi payment link only appears at the moment you choose to pay on a merchant's checkout, and it always lives on checkout.wompi.co — it is never pushed to you first in a message. Bancolombia is just as explicit that it never asks for your username, password, card number, security code, or expiry date by message, call, or email, and does not send links to 'confirm' or 'reactivate' your account that way. So any SMS, email, or WhatsApp that leads with a Wompi or Bancolombia link is the scam, not the service. If you need to pay or check something, open the official app or type the address yourself — never follow a link someone sent you.
Is Wompi itself legitimate, or is Wompi a scam?
Wompi is a legitimate payment gateway, not a scam. Its own support site describes it as part of the Ecosistema Bancolombia, and tens of thousands of Colombian businesses use it to take card and transfer payments online. So seeing the Wompi name at a shop's checkout is normal, and a Wompi charge on your statement usually just means you paid a merchant that uses it. What is not normal is Wompi contacting you directly. It is a checkout gateway: you meet it for a few seconds at the moment you pay, and it has no ongoing relationship with you as a shopper, so it has no reason to message you about a refund, an account, or a payment you need to 'confirm.' The name is what the scam borrows — the two checks that settle it are that a genuine Wompi link lives on checkout.wompi.co, and that a payment is only real when it appears in your own account.
I got scammed with a fake Wompi or Bancolombia payment. Where do I report it in Colombia?
Report it to the Policía Nacional's cybercrime channel, the CAI Virtual (caivirtual.policia.gov.co), and through ¡A Denunciar! (adenunciar.policia.gov.co), the joint Policía–Fiscalía system for cybercrimes under Ley 1273. If your bank account or card was involved, contact Bancolombia's fraud line immediately — they list a WhatsApp number (300 887 6817) for suspicious messages and the address correosospechoso@bancolombia.com.co for forwarding suspicious emails. Act fast: the sooner a transfer is flagged, the better the chance of stopping it.
Sources & further reading
Every fact in this piece is drawn from these sources. Click any to verify.