Risk: Elevated

#10DaysAgainstPhishing: How to unmask treacherous links

Category: Phishing · Published: 10/10/2026 · Last updated: 12/10/2026

Summary

What is this about? Current fraud case, reported by Watchlist Internet. See linked source for details.

Who is affected? Consumers in Germany.

How high is the risk? Elevated

Why is this warning issued?

This warning has been included because it is based on a report from Watchlist Internet. It is intended to protect other users from this fraud scheme. The assessed risk is elevated.

How the scam works

You receive an email or SMS that pretends to be from a bank, authority, or well-known company.
A fabricated problem is described – for example: the account needs to be verified, data must be confirmed, or a registration is about to expire.
The message contains a button that is supposed to solve the problem with one click.
At first glance, the button looks unsuspicious, but it leads to a fake portal.
On this portal, you are asked to enter login details, personal information, or online banking credentials.
With the stolen data, the criminals later contact you with new schemes or misuse your accounts.

How to recognise it

The domain visible via mouse hover or finger press does not match the alleged sender (e.g., bank or authority).
The address is a wild jumble of letters, numbers, and special characters.
The domain is unusually long or appears cobbled together.
A short-link service such as bit.ly is used, even though the context is already suspicious.
The domain name imitates well-known providers but deviates through additions or transposed numbers (e.g., 'meineoegkid1684…' instead of 'oegk.at').
The message creates pressure with allegedly urgent problems that are supposed to be solved by clicking a button.
Impersonal greeting and time pressure
Link to an external login page

How to protect yourself

On a computer: move the mouse cursor over the button and wait one to two seconds – the actual redirect address will appear automatically.
On a smartphone: press and hold your finger on the button for one to two seconds and keep it on the display so that the website does not open – the actual domain will appear next to it.
Authorities and official agencies never send emails or SMS containing a link – always be suspicious of such messages.
If you have entered login details: change the affected passwords immediately.
If online banking was affected: inform the bank immediately and monitor the account closely over the coming weeks.
Report phishing messages via the Watchlist Internet reporting form to protect others.

What you should never do

Do not click the button before you have verified the actual destination address.
Do not enter login details, personal data, or bank credentials on the page you land on.
Do not simply make a requested payment or 'confirmation' just because the message creates pressure.
Do not ignore the message if you have already entered data – act quickly and change passwords.
Do not lift your finger off the smartphone display immediately, otherwise the link will open.

Frequently asked questions

Do I have to pay something if I clicked on such a link?

Phishing emails usually do not demand direct payment, but data. If you do not enter any data and only click, often nothing bad happens. However, if you have entered data, change your passwords immediately and inform your bank if necessary.

Where did the criminals get my data?

This usually cannot be determined precisely. Data often comes from previous data leaks, hacked websites, or is traded on the internet. Even if your data comes 'only' from the phone book, you can become a target.

How can I tell where the link really leads?

On a computer: hold the mouse cursor over the button without clicking. On a smartphone: press and hold your finger on the button for one to two seconds without releasing. The actual address will then appear next to the cursor or button.

What should I do if I have already entered my data?

Change the passwords of the affected accounts immediately. If a bank account was affected, inform your bank immediately and monitor your account for unusual activity over the coming weeks. You can also contact the consumer advice center.

Should I delete or report the phishing message?

Ideally both: delete the message from your inbox after reporting it, and report it via the Watchlist Internet reporting form so that others can be warned.

Affected data

Scam type

Phishing

Comments

No comments yet. Registered users can share their experiences.

Related warnings

Original source

Find more information in the original source.

Watchlist Internet ↗

Update history

12/10/2026Description updated
10/10/2026Warning added from an official source