Quick answer
Verify independently through the official agency; do not use the message’s payment link.
Do now
Open the agency’s known website or call its published number. Check the actual account or ticket record. Preserve and report the suspicious message through appropriate channels. If information was exposed, use official identity-theft recovery guidance.
Watch for
Urgency, cryptocurrency demands, requests for passwords, and threats inconsistent with official procedure are warning signs. A real outstanding balance and a fraudulent message can exist at the same time.