Most online fraud starts with a message. It looks like it comes from someone you trust: your bank, a delivery company, a supplier, a colleague. It wants one of three things. You sign in on a fake page, you open a file, or you send money. This guide shows how each version works, how to check a message, and what to do if you already clicked.
What phishing looks like today
Phishing e-mails copy real brands closely. The logo, the footer and the sender's display name can all be faked. Spelling mistakes used to give them away. Scammers now use the same writing tools as everyone else, so a clean, polite message proves nothing.
The stories change with the season: a parcel held for a small fee, an account about to close, a tax refund, an invoice you do not recognise, a shared document, a sign-in alert. Three things rarely change:
- a reason to hurry;
- a link, a QR code or an attachment;
- a request you would not normally get, in a way you would not normally get it.
Smishing: the same trick by text
Smishing is phishing by SMS. Texts are short, so there is less to check, and links are often shortened. A sender name such as your bank's can be spoofed, so a fake text can land in the same thread as real ones. The same scams run on WhatsApp and other chat apps, for example the "Hi, it's me, I lost my phone, this is my new number" message that ends with a request for money.
Treat a text as a prompt to check, never as the place to act. Open your bank's app or type the address yourself. Do not reply, not even STOP: a reply tells the sender the number is live.
Payment redirection fraud
This one targets people who pay invoices. A supplier, a builder, a landlord or a lawyer handling a property sale writes to say their bank details have changed. The message often comes from the real e-mail account, because the attacker broke into it and waited. It arrives in the right thread, at the right time, with the right invoice attached. Only the account number is new.
The fix is a habit. Before you pay new bank details for the first time, call the person on a number you already had, from a past invoice, their website or your phone's contacts. Never use a number given in the message that announced the change. Ask them to confirm the new details out loud.
Banks now help. Since 9 October 2025, banks in the euro area must check the payee's name against the IBAN before you send a euro transfer, and tell you if it is a match, a close match or no match. This is called Verification of Payee. The UK has had a similar check, Confirmation of Payee, for years. If your bank warns you, stop and call. A match only tells you who owns the account, so it cannot tell you whether the request itself is genuine.
How to check a message
- Look at the full sender address, not just the name. On a phone, tap the name to see it.
- Before you press a link, hold your finger on it or hover the mouse to see where it really goes. A brand name in the middle of a long, odd address is a warning sign.
- Ask yourself whether this company would ask for this, this way. Banks do not ask for your full password or a code from your phone by e-mail or text.
- If there is any doubt, leave the message. Open the app, use a bookmark or type the address, and check there.
Passkeys help a lot here. A passkey only works on the site it was made for, so a look-alike page cannot use it, however good it looks.
If you clicked
Do not feel foolish. These messages are built by people who do this for a living. What matters is how fast you act. Start with the checklist below, then:
- If you opened an attachment, disconnect the device from the internet and run a full scan. On a work device, tell your IT contact straight away.
- If you sent money, call your bank at once on the number on your card or its website. A transfer can sometimes be stopped if the bank moves quickly. Then report it to the police.
- Report the message. In the UK, forward e-mails to
[email protected]and texts to 7726. In the US, use reportfraud.ftc.gov. Elsewhere, your national cybersecurity centre or the police will tell you where to send it.
The UK National Cyber Security Centre keeps a clear page on spotting and reporting phishing.
On Internetivo
Payouts on Internetivo go only by bank transfer to an account in your own name, and the name is checked on every new account. We send a "Was this you?" e-mail whenever your password, a passkey or a sign-in method changes. If one arrives that you did not expect, do not reply to it and do not call any number in it. Open internetivo.com yourself and check Activity, then the Security tab. Our guide to keeping your Internetivo account safe explains the freeze button and the rest.
Common questions
- The message uses my name and address. Does that make it real?
- No. Names, addresses and phone numbers leak in data breaches and are sold. Personal details are easy to get.
- The site has a padlock. Is it safe?
- The padlock means the connection is encrypted. Scam sites have padlocks too. It says nothing about who runs the site.
- Should I reply STOP to a scam text?
- No. Delete it and report it. A reply confirms that the number works.
- Will my bank refund me?
- Sometimes. It depends on your country, how you paid and how quickly you called. Call first, then ask.
When a message tells you to hurry, take the minute anyway.