#10TageGegenPhishing: How do criminals know so much about me?

Summary

Why is this warning issued?

This warning was included because it is based on a report from Watchlist Internet. It is intended to protect other users from this scam. The assessed risk is elevated.

How the scam works

• Criminals gather information: from social media, public phone directories, company websites, through internet research, from data leaks caused by hacks, or from previous fraud attempts.
• They make contact – by phone, email, SMS, WhatsApp, or chat – and use the collected details to build trust.
• Using phrases like 'suspicious transfer' or 'your account has been blocked,' they trigger fear or panic.
• During the conversation, they pressure you to hand over TAN codes, passwords, PINs, or to make a transfer.
• With the obtained data, they misuse accounts, cards, or identities – or attempt to defraud you again.
• Anyone who has responded once often ends up being targeted again, because the data is shared or traded.

How to recognise it

• The caller or sender knows your name, your account number, or your bank – it seems credible, but is not proof.
• You are asked for TAN, PIN, or passwords – banks and authorities never do this.
• Artificial time pressure is created, e.g., 'Act immediately!' or 'There is a suspicious transfer.'
• You are asked to click links or open attachments, even though the sender only seems vaguely familiar.
• The mentioned bank or authority matches by chance – guessing is also a common method used by criminals.
• Impersonal greeting and time pressure
• Link to an external login page
• Spelling or grammar errors, differing sender address

How to protect yourself

• Stay skeptical: personal details are no proof of authenticity – neither on the phone, via email, nor in chat.
• Never share TAN, PIN, or passwords. Banks and authorities never ask for such data by phone, SMS, or WhatsApp.
• Verify the identity yourself: Hang up and call back using the official number of your bank – never use the number provided in the suspicious contact.
• If you have already disclosed data: Contact your bank immediately, have your cards and access blocked, and change any affected passwords.
• File a report with the police and report the incident using the Watchlist Internet reporting form.
• Be aware: It is not your fault – social engineering is designed to deceive even cautious people.

What you should never do

• Do not let yourself be pressured by time – 'act immediately' is a classic warning sign.
• Do not click on links or open attachments hastily, even if the sender appears familiar.
• Do not call back the number provided in the call or message – it may be spoofed.
• Do not disclose any further sensitive data just because they seem to know personal details.

Frequently asked questions

Affected data

Comments

Related warnings

• Betrug in zwei Akten: Die nächste Runde im Klimabonus-Phishing
• Pensionsleistung genehmigt: 723-Euro-Versprechen ist Phishing
• #10TageGegenPhishing: Niemals klicken! Immer selbst einloggen!
• #10TageGegenPhishing: KI-gestützte Betrugsversuche erkennen
• #10TageGegenPhishing: Quishing – Wenn QR-Codes zur Betrugsfalle werden
• #10TageGegenPhishing: Wie geht man mit verdächtigen E-Mail-Anhängen um?

Original source

Update history

• 11/10/2026Description updated
• 10/10/2026Warning added from an official source