What do you need to understand first?
A copied profile and a compromised account can both produce convincing messages. Small details from a previous conversation do not prove that the person now typing is the person you know. The same applies to a copied public figure or supposed administrator.
What might this look like?
A familiar contact sends a replacement receiving address and asks you to hurry. You contact them using a previously known route, rather than the new details supplied in that message. Until the change is confirmed, you do not send.
Where is the safety checkpoint?
How can you work through it?
Notice the change
Look for a new address, secret request, unexpected link or pressure to keep the action private.
Leave the supplied route
Do not use a phone number or verification page provided in the suspicious message.
Confirm independently
Reach the person or service using details you already trust. Explain the request without disclosing wallet secrets.
Save the evidence and report
Keep the copied profile and message details. Warn an affected contact through a known route if you choose to, and use official reporting channels when appropriate.
When should you pause?
If you cannot confirm the request, leave it pending. A convincing voice, image or writing style is not enough to justify a payment or disclosure.