#10DaysAgainstPhishing: Real Number, Fake Caller – This Is How Spoofing Works

Summary

Why is this warning issued?

This warning was added because it is based on a report from Watchlist Internet. It is intended to protect other users from this scam method. The assessed risk is elevated.

How the scam works

• Criminals forge the sender information – in calls, emails, SMS messages, or websites – so that a trustworthy number, address, or a known company name is displayed.
• They contact you, often unexpectedly, and describe an urgent problem (e.g., a suspicious transfer on your account or an outstanding delivery fee).
• They create time pressure so that you do not check things calmly, but react immediately.
• They ask you to disclose sensitive data (PIN, TAN, password, payment data) or to confirm an authorisation in your banking app, which in reality triggers a transfer to the criminals.
• Or they send you a link to a fake page where you enter personal or payment data – this data goes directly to the fraudsters.
• With the stolen data, they attempt to further misuse you or your account, or launch new fraud attempts using your data.

How to recognise it

• The displayed phone number or email address matches the alleged sender, but the content seems odd – a classic sign of call ID or email spoofing.
• You are contacted unexpectedly and an urgent problem is immediately claimed (e.g., suspicious transfer, package could not be delivered).
• Massive pressure is applied: you are supposed to act immediately, right now, without thinking.
• PIN, TAN, passwords, or other access data are requested – by phone, email, or SMS.
• You are asked to confirm an authorisation in the banking app, cancel a payment, or pay a small amount (e.g., a €2.99 delivery fee) via a link.
• The link leads to a website that looks deceptively similar to the original, but has minimal deviations in the URL (URL spoofing).
• An SMS from an alleged company fits seamlessly into genuine SMS messages from the company and is therefore difficult to identify as a fake.
• Impersonal salutation and time pressure

How to protect yourself

• Never rely solely on the displayed sender information – check who is really behind the contact.
• In emails, click on the alleged sender to display the actual email address; if it does not match the sender, the email is fake.
• Never disclose PIN, TAN, passwords, or access data by phone, email, or SMS – legitimate banks and authorities never request this.
• When in doubt: end the contact and call the company yourself via the official website or a number you know.
• If you are affected: inform your bank immediately, change all passwords you have disclosed, and set up two-factor authentication if possible.
• File a report with the police and report suspicious messages via Watchlist Internet's reporting form to protect others.

What you should never do

• Do not call back the number given in the message or click on the given link – always use an official contact method you know.
• Do not disclose TANs, PINs, passwords, or confirmations in the banking app just because someone on the phone asks you to.
• Do not act under time pressure – the alleged urgency ('right now', 'immediately') is itself a warning sign.
• Do not pay smaller amounts 'without issue' via fake links – even €2.99 delivery fees can be the entry point for data theft.
• Do not continue talking to the caller or sender if something seems off – hang up and contact the company yourself.

Frequently asked questions

Affected data

Comments

Related warnings

• Betrug in zwei Akten: Die nächste Runde im Klimabonus-Phishing
• Pensionsleistung genehmigt: 723-Euro-Versprechen ist Phishing
• #10TageGegenPhishing: Niemals klicken! Immer selbst einloggen!
• #10TageGegenPhishing: KI-gestützte Betrugsversuche erkennen
• #10TageGegenPhishing: Quishing – Wenn QR-Codes zur Betrugsfalle werden
• #10TageGegenPhishing: Wie geht man mit verdächtigen E-Mail-Anhängen um?

Original source

Update history

• 11/10/2026Description updated
• 10/10/2026Warning added from an official source