How to recognise phishing emails and scam websites
Phishing means messages that pretend to come from your bank, a parcel service, a shop or a colleague. Their goal is to make you open a fake website and enter your password or payment details, or to open an attachment with malware.
Warning signs in an email or text message
- Pressure: "Your account will be closed today", "Payment overdue", "Confirm within 24 hours".
- The sender address does not fit: the name says "Your Bank", the address behind it is something else entirely.
- A general greeting such as "Dear customer" from a company that normally uses your name.
- A request for passwords, codes or card details. Real banks and shops never ask for them by email.
- Unexpected attachments, especially ZIP files, programs or documents that ask you to "enable content".
Check a link before you click
On a computer, rest the mouse pointer on the link without clicking: the real destination appears in the bottom corner of the browser or email program. Read the part just before the first single slash. "bank-example.de.secure-login.xyz" belongs to "secure-login.xyz", not to your bank. When in doubt, do not click: type the company's address yourself or use its app.
The padlock in the address bar only means the connection is encrypted. Scam websites have it too, so it is no proof that a site is genuine.
If you already entered your details
- Change the password at once, on the real website, and everywhere else you used it.
- Turn on two-step sign-in for that account.
- If you entered bank or card details, call your bank and have the card blocked.
- Watch your account statements for a few weeks.
How Malzox helps
Malzox web protection blocks known dangerous and scam websites for the whole PC, from your own list and the list Malzox publishes. A site that is on no list is not blocked, so the checks above stay your best tool. The link checker in Malzox lets you test an address and its warning signs without opening it.