#10DaysAgainstPhishing: Does it make sense? Three questions to counter fraudulent messages

Summary

Why is this warning issued?

This warning has been included because it is based on a report from Watchlist Internet. It is intended to protect other users from this scam. The assessed risk is elevated.

How the scam works

• Criminals send out phishing messages en masse, hoping to randomly reach people for whom the story happens to fit – e.g., someone is actually waiting for a parcel.
• The messages feel familiar because they reference well-known scenarios (parcel delivery, bank, tax office, public authority).
• A link lures you to a fake page that looks deceptively similar to the real website.
• There you are asked to enter personal data, login credentials, passwords, PIN/TAN, or payment information.
• Time pressure ('only today', 'within 24 hours') is used to prevent you from checking the message carefully.
• The data entered is used directly by the criminals for further fraud – e.g., account access, identity misuse, or follow-up phishing.

How to recognise it

• A message cannot be matched to any specific process (e.g., no order, no application, no outstanding invoice).
• A bank or public authority asks you by SMS, messenger, or email to enter PIN, TAN, or payment data via a link.
• A parcel service threatens additional charges for small amounts or puts you under time pressure.
• The message contains threats such as 'Your account will be blocked within 24 hours' or 'Confirm your data today'.
• The displayed sender name does not match the full email address when you view it.
• The message arrives via an unusual channel, although the organisation normally communicates differently (e.g., customer account, online banking, FinanzOnline).
• Generic greeting and time pressure
• Link to an external login page

How to protect yourself

• Before clicking, ask yourself three questions: Can I match the message to a real process? Would the company or institution really proceed like this? Can I verify the claim independently?
• For emails, display the full sender address and check whether it truly belongs to the organisation.
• When in doubt, open the official website or app yourself, or call a phone number you already know – not a number from the suspicious message.
• If you have already entered data or transferred money: contact your bank immediately, change affected passwords, and use new, unique passwords for this.
• Where possible, enable two-factor authentication.
• File a report with the police, especially if there is financial damage or if sensitive data could be misused, and report suspicious messages via the Watchlist Internet reporting form.

What you should never do

• Do not click on links in unexpected messages just because the sender or logo looks familiar.
• Do not enter any PIN, TAN, passwords, or payment data via a link from a message.
• Do not let yourself be put under time pressure – not even by threats of account suspension or frequent additional charges.
• Do not trust the displayed sender name alone; always check the full sender address.
• Do not respond to demands that seem unusual to you without verifying them through an independent channel.

Frequently asked questions

Affected data

Comments

Related warnings

• Betrug in zwei Akten: Die nächste Runde im Klimabonus-Phishing
• Pensionsleistung genehmigt: 723-Euro-Versprechen ist Phishing
• #10TageGegenPhishing: Niemals klicken! Immer selbst einloggen!
• #10TageGegenPhishing: KI-gestützte Betrugsversuche erkennen
• #10TageGegenPhishing: Quishing – Wenn QR-Codes zur Betrugsfalle werden
• #10TageGegenPhishing: Wie geht man mit verdächtigen E-Mail-Anhängen um?

Original source

Update history

• 11/10/2026Description updated
• 10/10/2026Warning added from an official source