Before the signature.

A payment request deserves the same scrutiny as a transaction. Read the complete recipient, the chain identifier, the asset contract and the expiry. A recognisable ticker is not an identity check. The review step should show the exact requirements and leave authorization with the wallet. Discovery never needs a private key.