A phishing email, four traps, three languages – When criminals work sloppily

Summary

Why is this warning issued?

This warning was included because it is based on a report from Watchlist Internet. It is intended to protect other users from this fraud scheme. The classified risk is elevated.

How the scam works

• Criminals are mass-sending emails with the sender name 'FinanzOnline.at' via hacked mail servers of a Guatemalan university.
• The email announces an income tax refund.
• As a final step, a supposedly one-time identity verification is requested via the 'secure FinanzOnline platform'.
• A fake portal uses logos to imitate the web presence of Austrian authorities and requests tax number, date of birth, IBAN, and credit card data.
• The criminals use ready-made fraud kits with pre-programmed modules and only superficially adapt them to the target country.
• Due to sloppy work, the links were not adjusted and lead to the German ELSTER portal instead of an Austrian equivalent.
• Three additional modules (a Greek fake invoice, English texts about a garden and a library, and a 'Prepmymeal' section) were accidentally left in the email.

How to recognise it

• Sender name 'FinanzOnline.at', but sent via hacked mail servers of a Guatemalan university
• Promised income tax refund with a request for a 'one-time identity verification'
• Request for sensitive data such as tax number, date of birth, IBAN, and credit card data on a linked portal
• Redirection links do not lead to FinanzOnline but to the German tax portal ELSTER
• The email contains a Greek fake invoice from the alleged company 'SEB Services' with the domain 'seb.ee' of the Estonian SEB Bank
• Two short English text sections about a community garden and a library renovation that are out of place in an alleged official authority email
• An additional section in which the criminals pose as the meal prep company 'Prepmymeal'
• Impersonal greeting and time pressure

How to protect yourself

• Do not click on links in emails that announce a refund or an identity verification.
• Check the sender address and link target carefully – real authorities do not request sensitive data via email links.
• Do not enter your tax number, date of birth, IBAN, or credit card data on linked portals.
• Report suspicious emails to your consumer protection center or the police.
• If you have already entered data: immediately change affected passwords, inform your bank, and file a report with the police.
• Then delete the email.

What you should never do

• Do not click on the redirection button or other links in the email.
• Do not enter any personal or financial data on the linked fake portal.
• Do not reply to the email and do not respond to any follow-up inquiries.
• Do not let yourself be pressured by alleged urgency.
• Do not pay any amounts demanded in the Greek fake invoice or other invoices you do not recognize.

Frequently asked questions

Affected data

Comments

Related warnings

• Phishing-Radar: Aktuelle Warnungen
• Phishing-Mails: Woran Sie sie erkennen und worauf Sie achten müssen
• Betrug: Phishing-Mails und falsche SMS von Ministerien und Behörden
• Phishing-Mails zur Datenbestätigung
• Betrug in zwei Akten: Die nächste Runde im Klimabonus-Phishing
• Pensionsleistung genehmigt: 723-Euro-Versprechen ist Phishing

Original source

Update history

• 19/09/2026Description updated
• 16/09/2026Warning added from an official source