How do I recognize a phishing email or text message?

Phishing alert: How to unmask digital traps

Phishing attacks are one of the most common and dangerous forms of cybercrime. Learn how to reliably identify fake emails and text messages – before the damage is done.

The Psychology of Deception: Why We Fall for It

Criminals are not tech geniuses – they are masters of human psychology. Their methods are specifically designed to exploit our weaknesses.

Fear & Time Pressure

Classic warnings like "Your account will be blocked in 60 minutes!" are designed to force you into rash, impulsive action. When you're panicking, you don't think critically.

Greed & Curiosity

Promises of winnings, refunds, or exclusive offers appeal to the desire for a quick advantage – and eliminate healthy skepticism.

Deceptively realistic design

Modern phishing emails use stolen logos, correct company colors, and professional language. The difference from the original is often barely noticeable.

The three warning signs that expose every phisher

Three key characteristics can be found in almost every phishing attack. If even one of them appears, extreme caution is advised.

Behind the facade: Check the sender

The displayed sender name can be forged at will. What's crucial is always the real email address hidden behind it – and that often gives everything away.

Uncover the real address

Click or tap the displayed sender name to see the full email address. "PayPal Support" may be behind an address like... noreply@secure-login.ru be hidden.

Check the domain carefully

Watch out for subtle spelling mistakes: bank-sicherheit.ru, sparkasse-online.net or paypa1.com (with the number 1 instead of the letter l) are typical forgeries.

Follow the SMS rule

Banks and payment service providers never send login links or payment requests via SMS. Such messages should be deleted immediately.

The website trap

Many people believe that a padlock symbol in the browser address bar means security. This is a dangerous misconception – phishing sites also use HTTPS and therefore appear trustworthy.

Check HTTPS – but don't trust it

The padlock icon only indicates that the connection is encrypted. It says nothing about whether the website itself is trustworthy. Criminals deliberately use HTTPS to feign security.

Read the URL carefully

Check the full address: Is the domain name exactly correct? Are there any strange character combinations, subdomains, or similar? login.bank.phishing.com or unknown country code?

Re-entering data = Stop

If you are asked to re-enter your IBAN, card number, or TAN after logging in, cancel immediately. No legitimate service will request this after registration.

Emergency: What to do if it happens?

Even vigilant people can fall victim to perfectly executed phishing attacks. What you do in the first few minutes afterward is crucial – acting quickly significantly limits the damage.

Stay calm & document

Immediately take screenshots of the message and the pages visited. This evidence is important for filing a police report and notifying the service provider.

Change passwords immediately

Change the password for the affected account immediately – and for all other accounts where you used the same password. Enable two-factor authentication.

Providers inform

Contact the affected service via official channels (website, app, telephone hotline). Never use contact details from the phishing message itself.

Contact bank

Have you shared financial information? Immediately call your bank's emergency hotline (in Germany: 116 116). Have any affected accounts or cards blocked without delay.

Conclusion: Your security mindset

The most effective protection against phishing is not technical tools, but a trained awareness. These three principles will keep you safe in the long run.