Go back

Phishing

Phishing

Idea: An information page about current phishing cases/trends or a graphical explanation of how phishing works, making it easy for everyone to understand (first step / rules, etc.)

What is phishing and how can I recognize it?

Phishing is essentially an attempt to steal your personal data. This primarily includes any login credentials for your email, bank account, Amazon/PayPal account, or information related to your credit card. Such messages can often be identified by spelling mistakes, unusual sender addresses (e.g. an address with an overseas domain), or other inconsistencies in the phishing message. Attackers often exploit the sense of urgency that can cause victims to panic (“Oh no, I need to enter my details quickly, otherwise I’ll lose my account!”).

Phishing attacks are particularly dangerous because they can be extremely difficult to distinguish from legitimate messages. Attackers deliberately exploit their victims’ fear or the sense of urgency created by messages such as “Your account will be blocked!”

Examples:

  • Email (Sparkasse, Volksbank, PayPal, etc.)
  • Phone phishing (calls from scammers pretending to be employees of PayPal or Microsoft)
  • Phishing via social media
  • SMS (Smishing = a combination of SMS and phishing. It is a form of fraud carried out via text messages, using fake SMS messages that appear to come from banks or parcel delivery services.)

Most common methods:

  • “Hi Dad/Mom, this is my new number.”
  • “Your Volksbank TAN is invalid – please update it…”
  • “Unusual activity has been detected on your account – please check!”
  • “Your package could not be delivered. Please update the delivery location.”

How does phishing work?

  1. As a victim, you receive a message that looks legitimate at first glance: “Your account will be blocked – action required!”

  2. You panic, click the link included in the fake message, and are redirected to an external URL that, at first glance, may not immediately appear to be fake.

    Example:
    Here, the fake message can be identified by the unusual domain ending.

  3. By clicking the link or entering your login credentials on the corresponding fake website, the attacker gains access to the information you entered.

IMPORTANT: If you notice something like this, change your password immediately, check your device for malware, and contact the relevant provider’s support team — in the example above, PayPal Support. If possible, you should also immediately file a police report or report the incident to Netzmelden using screenshots that provide reliable evidence (a screenshot of the entire screen including the time; on a PC, include the taskbar).

  • Step 1 – Stay calm.
  • Step 2 – Disconnect your device from the LAN/Wi-Fi network. If your PC or laptop is connected via an Ethernet cable, simply unplug it.
  • Step 3 – Change your credentials. If possible, immediately change your password and, if necessary, your email address. Keep a particularly close eye on your account(s) for the next few days.
  • Step 4 – Contact the affected providers, such as PayPal or Amazon Support. They can usually advise you on the next steps to secure your account again.

Sources:

  • BSI – Federal Office for Information Security
  • Datenschutz-Experte
  • Polizei NRW – Cybercrime

More Articles