Messages about a held parcel, a blocked account or unpaid electricity reach everyone. These days they no longer contain comical typos and they look as though they came from a real company. These are the signs that give them away.
They put you under time pressure
“Within 24 hours”, “or your account will be closed”, “final notice”. This is the single most reliable giveaway. A real bank or government office does not force you to act immediately by email. The urgency has one purpose: to stop you thinking.
The link goes somewhere other than it claims
On a computer, hover the mouse over the link but do not click. The bottom corner of the browser shows where it actually leads. On a phone, press and hold the link and the address appears.
Look at what sits immediately before the first slash. For the real Česká spořitelna that would be csas.cz. For a scam it might be something like csas.overeni-uctu.xyz — the beginning matches, but the real domain is the one at the end.
A greeting with no name in it
“Dear customer”, “Hello, user”. Your bank knows your name and will use it in an email. A bulk mail-out cannot.
They ask for details they already have
No bank, postal service or government office will ever ask you by email or phone for a password, a PIN, a full card number or a code from a text message. They either have these details or do not need them. Anyone who asks is a fraudster. Without exception.
The sender's address
Open up the sender and look at the actual address, not just the display name. “Česká pošta” can sit above an address like info@ceska-posta-zasilky.info. Anyone can set the name; the address they cannot.
The rule that always works
You do not have to be able to spot everything. One rule is enough: never click a link in a message. Open the site yourself.
If a message arrives from your bank, close it and sign in to your online banking the way you normally do. If a message arrives about a parcel, go to the carrier's site and type the tracking number in by hand. If the message was genuine, you will see it there too. If it was not, nothing has happened.
If you have already clicked
It can happen to anyone. Move quickly, but do not panic:
- If you entered a password, change it immediately — and everywhere else you used the same one.
- If you entered card details, ring the bank and have the card blocked. The number is on the back of the card and in the app.
- If you downloaded and ran something, disconnect the computer from the internet and get in touch with me.
And do not be embarrassed about it. These days people who work with computers fall for them too.