Scam in two acts: The next round of Klimabonus phishing

Summary

Why is this warning issued?

This warning has been included because it is based on a report from Watchlist Internet. It is intended to protect other users from this scam. The assessed risk is elevated.

How the scam works

• Victims receive a phishing email in the name of the BMF stating that an application for the 2026 Klimabonus is still pending and the deadline is approaching.
• The email references amounts between 145 and 400 euros and asks recipients to update their stored bank details - clicking the button takes them to the fake portal klimabonusat.com.
• On the imitated portal, extensive personal data is requested: first and last name, social security number, date of birth, address, phone number.
• Next, the bank details are captured, including a selection of the bank and entry of the IBAN, after which a success message appears.
• To conceal the scam, the user is redirected to the genuine site oesterreich.gv.at to feign legitimacy.
• Some time later, someone calls and poses as a bank advisor from the victim's own bank, claiming they have noticed unauthorized access to the account.
• The people called are guided step by step over the phone through various actions and pressured into sharing authorization codes, which then enables the criminals to make debits from the account.

How to recognise it

• The sender address of the email does not match that of the Austrian Federal Ministry of Finance (BMF).
• The fake portal uses the domain klimabonusat.com instead of the genuine domain klimabonus.gv.at - according to the source, this domain was only registered on 30 September 2026.
• The imprint of the fake portal lists a company called 'Klimabonus Service GmbH' with purported company register number and VAT ID, which do not exist or are invalid.
• The contact details provided include a German phone number with the +49 prefix and an email address using a German domain - inappropriate for an alleged offer from Austrian authorities.
• The Klimabonus was already discontinued at the end of 2024 - there are no new payment rounds.
• Impersonal salutation and time pressure
• Link to an external registration page
• Spelling or grammatical errors, deviating sender address

How to protect yourself

• Always verify emails with links to government offers by typing the known official address (e.g., klimabonus.gv.at directly into the browser) rather than following the link in the email.
• Never enter personal data such as your social security number, date of birth or IBAN on unknown websites - especially not via links from emails.
• If you receive a call from a supposed bank advisor, hang up immediately and contact your bank yourself using the official phone number on your card or account statement.
• If you have already disclosed authorization codes, inform your bank immediately so that transfers can possibly still be stopped.
• If you have shared your online banking login details, change your password immediately and file a police report.
• If in doubt, seek guidance from a consumer protection center.

What you should never do

• Do not click on links in emails that lead to Klimabonus or BMF offers - always enter addresses manually.
• Do not enter social security numbers, dates of birth, address data or bank details on unknown portals.
• Do not share authorization codes, TANs or online banking login details with callers - genuine banks never request these over the phone.
• Do not let yourself be pressured into acting quickly - criminals deliberately use threats like alleged 'unauthorized account access' to force hasty action.
• Do not independently carry out 'damage-limitation transfers' because someone on the phone asks you to.

Frequently asked questions

Affected data

Comments

Related warnings

• Pensionsleistung genehmigt: 723-Euro-Versprechen ist Phishing
• #10TageGegenPhishing: Niemals klicken! Immer selbst einloggen!
• #10TageGegenPhishing: KI-gestützte Betrugsversuche erkennen
• #10TageGegenPhishing: Quishing – Wenn QR-Codes zur Betrugsfalle werden
• #10TageGegenPhishing: Wie geht man mit verdächtigen E-Mail-Anhängen um?
• #10TageGegenPhishing: Warum Phishing-Fallen immer mit Druck arbeiten

Original source

Update history

• 10/10/2026Description updated
• 08/10/2026Warning added from an official source