What Is a Phishing Email?
Phishing is an attempt to trick you, by email, into giving away personal information — for example your username, your password, or a one-time code (a short number you use to confirm a transfer, sometimes called a TAN). The email can look convincingly like it comes straight from your bank. The scammers' goal: access to your account, your everyday banking, or your savings.
Your bank will almost never email you asking you to enter your password or a one-time code. That is the single most important rule to remember.
Common Warning Signs of a Phishing Email
Phishing emails tend to follow a similar pattern. Watch for these signs:
- Urgency: "Your account will be blocked in 24 hours" or "Act now". A real bank does not pressure you like this.
- A generic greeting: "Dear customer" instead of your real name. Your bank knows your name.
- The sender's address: It looks similar to the real one but isn't — for example "service@yourbank-support.com" instead of the bank's actual domain. Check the whole address, not just the display name.
- Spelling and grammar mistakes: Odd phrasing, wrong punctuation, or text that reads like a poor translation.
- A request for your login details: A link asking you to log in "for security", "confirm" your password, or enter a one-time code.
- Suspicious links or attachments: Buttons like "Verify now" or attachments you are told to open.
How to Check a Link Safely, Without Clicking It
You do not have to guess. A few simple checks show you where a link really leads before you click it.
On a computer
Hover your mouse pointer over the link without clicking. The real destination address appears at the bottom of your screen. If it does not match your bank's actual web address, that is a warning sign.
On a phone
Press and hold the link briefly, without letting go. A small menu opens showing the real address.
Look closely at the address. Scammers often use domains that look very similar to the real one — with an extra word, a hyphen, or swapped letters. The one truly safe method: open a new tab in your browser and type your bank's address yourself, or use a bookmark you saved earlier. Never click a link in an email to log in.
The same caution applies when you open a new everyday account online, apply for a loan, or put money into deposits: always use your bank's official web address or a trusted comparison site.
What to Do If You Already Clicked a Link or Entered Your Details
Has it already happened? It can happen to anyone, and there is no reason to feel ashamed. What matters now is acting quickly and calmly.
- Call your bank immediately — using the phone number on your bank card or on its official website, never a number from the suspicious email.
- Ask them to temporarily block your online access.
- Change your online banking password as soon as you can, ideally from a different, secure device.
- Check your account statement for any transactions you do not recognise and report them to your bank right away.
- File a report with the police. This also matters for insurance and liability purposes.
Never give a one-time code to anyone who calls you claiming to be "from the bank" — not even over the phone. Your bank will never ask you for it.