The victims can find the threat actor’s user name through specific group chat software or follow a chat group link in the ransom note.  Ransom payment operations are complicated and highly automated processes.