Although we’ve known about payday loan scams for more than a decade, it still costs consumers over $500 million in each.

The scam works like this: you’ll get a call pretending to be a collection agency representative. That person says you need to pay your outstanding balance on a payday loan.

You’ll get asked to confirm your identification. That’s your first hint. Anyone who was collecting a legitimate debt would already have these details. Don’t tell them anything!

Top Red Flags to Watch for with Payday Loans

Here are some other tricks that scammers use to try to take your money or personal identification information.

1. You get told to pay or get arrested.

Legitimate loan companies will never threaten you with an immediate arrest for not paying your bills. If you haven’t been served with a court summons, debt is rarely something that police officers will get involved with handling.

2. You don’t get a name.

If a caller refuses to identify themselves, you should hang up on that person immediately. A legitimate collection call should have no problem telling you their name and that of their employer.

3. You cannot find any corroborating information.

Some companies use made-up names. Before divulging any information, you can look them up online to see if they are legitimate. If you cannot locate any proof of existence, it’s time to ignore whatever comments or threats come along.

4. You do not have a validation notice.

Anyone representing a legitimate collection agency must send a validation letter. This info tells you the debt details and allows you to dispute it within 30 days. If you don’t have one, you’ve probably encountered a scam.

5. You must make an immediate payment.

A legitimate payday loan collector will accept any payment form, including a monthly plan to get rid of the debt. If someone insists you pay over the phone that day, don’t give them your info.

If you’ve never taken out a payday loan, please report anyone who tries to say otherwise. You might also want to investigate your identity information to see if it has been compromised.