You should receive payment before releasing assets. Payment receipt alone is not enough proof. Report user immediately