10 messages like the ones that land in inboxes every day. Decide whether you would trust them – and learn how to spot scams.
All companies, people and addresses are made up. The ending “.example” stands for any domain.
Note: The parcel service’s real website is parcelservice.example.
Text message
Parcel service
Your parcel could not be delivered. Please confirm the new delivery: parcelservice-delivery.example/k9
Fake. The link does not lead to parcelservice.example but to a different domain.
How to tell:
Note: Sample Bank’s real website is samplebank.example.
Sample Bank <service@samplebank.example>
Your October statement is ready. Please sign in to our app as usual.
Real. No link, no deadline, no request for data – just a reminder to use the app you know.
How to tell:
Note: Sample Bank’s real website is samplebank.example.
Sample Bank Security <security@samplebank-account.example>
Your account has been restricted. Confirm your details within 24 hours or it will be locked: samplebank-account.example/login
Fake. “samplebank-account.example” is not “samplebank.example”. Add the threat and the deadline.
How to tell:
Note: The message comes from a number that is not in your contacts.
Messenger
Unknown number
Hi Mum, this is my new number. My phone is broken. Can you quickly transfer €870 for me? I’ll explain later.
Fake. The “Hi Mum” scam: call your child on the old, known number before sending money.
How to tell:
Note: The real website is streamingservice.example.
Streaming service <info@streamingservice.example>
Your last payment failed. Update your payment details now: streamingservice.example.account-update.example/pay
Fake. Read the domain from the right: the link leads to “account-update.example”. The familiar name in front is just camouflage.
How to tell:
Note: You have just signed in to Sample Shop yourself.
Text message
Sample Shop
Your verification code is 482913. Never share it with anyone.
Real. You requested the code yourself and there is no link. Only enter it on the page where you are signing in.
How to tell:
Note: Your company only uses addresses ending in company.example.
Management <boss.office@company-mailbox.example>
I am in a meeting. I urgently need gift cards worth €2,000 for a client. Please keep this confidential and send me the codes.
Fake. Classic “CEO fraud”: outside address, pressure, secrecy and gift cards. If in doubt, call directly.
How to tell:
Note: You ordered from Sample Shop yesterday. The real website is sampleshop.example.
Sample Shop <orders@sampleshop.example>
Thanks for your order 48213. You can find tracking details in your customer account: sampleshop.example/account
Real. Expected order confirmation, real domain, no deadline and no request for data. Still: if in doubt, open the site yourself.
How to tell:
Note: Authorities do not send refunds via text message links.
Text message
Tax office
You are entitled to a tax refund of €384.20. Apply here: tax-refund-online.example
Fake. Money from the authorities via a text link is a classic lure. Refunds come via your tax assessment and your known account.
How to tell:
Note: The email mentions an old password that you actually used in the past.
Unknown <no-reply@secure-mail24.example>
I have access to your device and filmed you. Pay €1,200 in Bitcoin or I will send the video to all your contacts.
Fake. Mass extortion: the password comes from an old data breach. Do not pay, do not reply, change the password.
How to tell:
Received a suspicious message? Check it with our free tools.
Breach Check