Purported ÖGK phishing warning is actually a phishing trap

Summary

Why is this warning issued?

This warning was included because it is based on a report from Watchlist Internet. It is intended to protect other users from this fraud scheme. The assigned risk level is elevated.

How the scam works

• Criminals contact people insured with the Österreichische Gesundheitskasse by email.
• They pose as ÖGK and design the message with a logo, green coloring and official language.
• The email initially warns at length about known phishing emails promising a refund. This is intended to build trust.
• The subsequent section requests purported verification of the user's data.
• A 24-hour deadline and the threat of automatic account or data blocking are intended to prompt quick action.
• The link or button is intended to collect verification data. The perpetrators can use the information they obtain for further fraud attempts.

How to recognise it

• The email threatens to automatically block accounts or data if verification is not completed within 24 hours.
• According to the fine print, the verification is to be free of charge but mandatory.
• A link or button leads to purported verification of the user's data or to an online request for a refund.
• The email uses the ÖGK logo, the typical green coloring and an official tone.
• The visible sender name is beratung #OEGK. The address behind it, however, belongs to a Japanese auditing and tax advisory firm and has nothing to do with ÖGK.
• According to the source, the consistent use of OEGK instead of ÖGK cannot be explained in a credible way and is therefore at least another warning sign.
• Impersonal greeting and time pressure
• Link to an external login page

How to protect yourself

• Do not open the link or button and do not enter any personal data. Delete the message afterward.
• If credit card or account details have been disclosed, immediately contact the credit card provider or bank and clarify whether blocking is necessary.
• If online banking access data have been disclosed, immediately contact the bank and change the password if possible.
• Carefully review account and credit card statements over the following weeks. Immediately inform the bank or credit card provider of any unusual transactions.
• Preserve the email, including the sender address, link and time of contact, as evidence and report it to the police if necessary.
• For further contact, use official ÖGK contact details that you have independently verified and remain vigilant, as the perpetrators may return with other schemes.

What you should never do

• Do not click the link or verification button in the message.
• Do not enter personal data, credit card information, account details or online banking access data.
• Do not accept the 24-hour deadline or the purported account block as a pressure tactic.
• Do not ignore data that have already been submitted; immediately contact the bank or credit card provider concerned.

Frequently asked questions

Affected data

Comments

Related warnings

• #10TageGegenPhishing: Warum Phishing-Fallen immer mit Druck arbeiten
• #10TageGegenPhishing: Kein finanzieller Schaden? Warum die Falle dennoch gefährlich ist!
• #10TageGegenPhishing: Ergibt das Sinn? Drei Fragen gegen Betrugsnachrichten
• #10TageGegenPhishing: So enttarnen Sie verräterische Links
• #10TageGegenPhishing: Echte Nummer, falscher Anrufer – so funktioniert Spoofing
• #10TageGegenPhishing: Woher wissen Kriminelle so viel über mich?

Original source

Update history

• 30/10/2026Description updated
• 29/10/2026Warning added from an official source