You receive a message saying your account will be blocked unless you confirm your details. The logo looks right, and the button opens a familiar-looking login form. Meanwhile, your work inbox might receive an equally convincing request to pay an invoice urgently. In both cases, the scammer is counting on you to act before you pause and check the details. Find out how to recognise phishing, verify these requests safely and respond if you have already shared your information.
What is phishing, and why can a fake message look genuine?
Criminals impersonate banks, shops, public authorities and people you trust. They might try to persuade you to reveal a password, share a BLIK payment code or send money. That is how phishing works: rather than breaking through your device’s defences, the scammer uses a convincing story to get you to take the bait and act.
The story does not have to be unusual. If you are expecting a parcel, a message about a delivery problem fits your situation. If you handle payments at work, a supplier’s request for a bank transfer can look like another task on your list. It is easy to treat these messages as routine, especially when you are busy.
That is why looking for typos and awkward sentences is not enough. A fake message can be well written, use a familiar logo and arrive at just the right moment. Nor does it have to come by email or text. An advert, a QR code or a request sent from a friend’s compromised Facebook account can also lead you into a scam.
The sender’s displayed name therefore does not prove that the message is genuine. Before responding, check what you are being asked to do and where you are being asked to do it.
Can simply clicking a link be dangerous?
Opening a suspicious page does not automatically mean that someone has taken over your phone or emptied your bank account. In a typical phishing scam, the attacker still needs you to do something. They want you to fill in a form, approve a transaction or install a particular program. Simply loading the website is usually not enough to steal money or infect your device.
There are exceptions, however: a criminal may exploit a flaw in your browser or operating system to infect your device as the page opens, without you entering any information or installing anything. These attacks are rare and usually target specific people, but they still need to be taken seriously. That is another reason to install regular updates that fix known security vulnerabilities.
What is the scammer really after?
Phishing can lead to stolen money, account takeover or identity theft. To achieve this, a scammer presents their request as an ordinary task: signing in, making a small payment or verifying your details. Here is what may actually be happening:
Taking over an account. A message sends you to a fake login page. If you enter the password for your email, online banking or a company system there, you hand it to the criminal.
Stealing card details. Someone claiming to be a courier asks you to pay a small extra fee. The form looks like a way to pay for delivery, but it is designed to capture your card number, expiry date and CVV. The scammer can then try to use those details to spend your money.
Stealing money with BLIK. Someone says they need your BLIK code to pay you for an item you have sold. In fact, the code is used to make a payment or withdraw money from your account, not to receive a bank transfer.
Approving an action in your online banking. A scammer insists that you must enter a code from a text message to receive money. In reality, you may be authorising something else, such as adding their device to your online banking. Read the bank’s entire message: check what the code authorises and, if it concerns a payment, check the amount and recipient too.
Stealing your identity. Under the pretext of verifying your identity, someone asks for your PESEL number, a photo of your ID or a selfie holding the document. They can later use that information to impersonate you, for example when trying to take out a fraudulent loan.
Installing malicious software. A scammer sends you a ‘banking app’ or an ‘update’ to download from outside the official app store. Instead of the tool you were promised, you may install software designed to steal information.
Gaining remote access. Someone claiming to be a support adviser asks you to run a program so they can ‘help’ resolve a problem. If you grant access, they can operate your computer, for example by sending messages from your email account, installing malware or copying business and personal documents.
Running a dangerous command. A fake CAPTCHA, supposedly a test to check that you are human, tells you to copy some text and paste it into a system window. This is not a verification step: the pasted command may install malware.
Do not judge a request solely by the explanation given for it. Check what you are actually authorising, who you are sharing information with and which website you are entering it on.
How can you check which website you are really on?
If a page opened from a message link looks suspicious, do not enter any information. Even if it looks exactly like your bank’s or a shop’s website, it may be a copy. Checking the address in your browser’s address bar can help you spot the deception.
Check the domain: the website’s name in its address. Consider this fictional example: your bank uses the domain mybank-coolfinances.com. The address mybank-coolfinances.com.confirmation.com, however, belongs to confirmation.com. The familiar name at the beginning is meant to make you think you are in the right place. Finding a word associated with the company somewhere in the address is therefore not enough. You need to compare the full domain with the one the company actually uses.
If you do not remember the correct address, do not take the risk. Open an app you have used before or use a saved bookmark you trust. Do not assume the first search result is genuine either: scammers can buy adverts that lead to fake websites.
What makes a request suspicious?
As well as checking the address, consider how the sender is trying to get you to act. Pay particular attention to these warning signs:
Time pressure: a threat to block your account or return a parcel to the sender is meant to make you act without thinking.
Strong emotions: a message about an unfamiliar transaction or a loved one in trouble can frighten you, while the promise of a prize encourages you to claim it quickly.
A small extra payment: a few dollars may seem too little to bother checking, while the scammer is really after the details you enter when paying.
An unfamiliar sender: for example, a message from a phone number or email address you do not recognise. Be especially cautious if the sender claims to be someone close to you.
An unusual way of handling the transaction: someone claiming to want to buy your item asks you to move from the marketplace to a messaging app, then sends instructions for receiving payment there.
Language errors or an unusual writing style: odd phrases, unnatural sentence structure or a style noticeably different from earlier messages may suggest that someone is impersonating the sender.
The absence of these warning signs does not make a message safe. A scammer can write correctly and without rushing you. They may also use a friend’s compromised account, so even a familiar sender does not prove who is actually contacting you.
That is why you should verify requests for money or information through a different channel. Call your friend on a number you already have saved. Contact a bank or shop through an app you have used before or a website you know is genuine. Do not use phone numbers or links supplied in the message you are trying to check.
Phishing at work: what is different?
A fake website is not always needed to steal a company’s money. A scammer may impersonate a supplier and say that an invoice must be paid into a new bank account. The employee appears to be carrying out a routine task, but the money goes to the criminal.
That is why a company should have a standing rule for verifying changes to payment details. Before using a new account number, the accounts team should confirm it with the supplier by calling a number they already know. An unusual transfer request from someone claiming to be a manager needs the same checks. Neither urgency nor the sender’s seniority should override this rule.
Employees also need to know who to tell about suspicious messages and their own mistakes. If someone enters a work password on a fake website, the person responsible for IT needs to know immediately. A compromised mailbox can be used to send further requests for money or information, this time to colleagues and customers.
Fear of punishment or ridicule must not stop people from reporting these incidents. A quick response can limit the damage, and tools that block dangerous websites and messages can provide additional protection for employees.
Which security measures help protect your accounts?
Alongside staying alert and checking messages yourself, you can use tools that help prevent you from handing information to a scammer. Some can recognise the legitimate website even when you find it difficult to tell it apart from a fake.
A password manager stores each password with the domain of the service it belongs to. It will therefore not offer to autofill that password on a fake site at a different address. If the usual autofill suggestion suddenly fails to appear, treat that as a warning: do not enter the details manually without checking why. If you do not yet have a password manager, we recommend Bitdefender SecurePass, which you can buy in our Allegro shop.
Another option is passkeys, which let you sign in without a traditional password. They are tied to a particular service, so a fake site cannot use them to confirm a sign-in. There is no password to steal through a fake form.
A similar safeguard is a FIDO2-compatible hardware security key: a small device you use to confirm a sign-in. It can replace a password or provide an extra security step after you enter one. In both cases, it verifies the domain and will not approve a sign-in on a fake copy. For more about how these keys work, how to set them up and which model to choose, read our guide to hardware security keys.
If you use a password, it is also worth enabling two-factor authentication, which adds another step to confirm a sign-in. This makes account takeover harder for someone who has learned your login details. However, if that extra step uses a code from a text message or an app, a scammer may try to trick you into sharing it too. Always check what you are authorising.
Also keep your operating system, browser and apps up to date. Updates fix vulnerabilities exploited in less common attacks where simply opening a specially crafted page can infect your device.
Security software: an extra layer of protection against phishing
Checking messages and securing your sign-ins can be backed up by software that detects suspicious websites. If it identifies a site designed to steal information, it can block the page from opening. That provides additional protection if a convincing message leads you to click a fraudulent link.
Bitdefender is one of the brands that offers these capabilities, with products for home and business use. As an authorised partner, we can help you choose protection that suits your needs and the devices you use.
Bitdefender for home use
Home security packages help block sites impersonating banks, shops and other trusted services. When choosing a package, consider how many devices it covers and which operating systems you use. The features available on a Windows computer may differ from those on an Android phone or an iPhone.
Bitdefender GravityZone for businesses
At work, protecting individual computers is only part of the task; it also helps to manage them from one place. Bitdefender GravityZone lets an administrator configure security across multiple devices, check their status and monitor detected threats. Its anti-phishing protection helps block fake websites before an employee enters work-related information.
GravityZone comes in several versions, including Business Security, Business Security Premium and Business Security Enterprise. Additional modules, such as business email protection, can extend its coverage. You do not need to choose the most extensive version to start protecting your devices more effectively. To understand the differences and see which option suits your business, read our comparison article.
What should you do if you share information with a scammer?
If you realise that a criminal has obtained your information, do not wait until you notice an unfamiliar transaction or lose access to your account. What you need to do next depends on what they have obtained:
Card details or access to online banking: contact your bank as soon as possible and explain what happened. If you disclosed your card details, ask the bank to block the card. If you shared a banking username, password or authorisation code, report the possible account takeover and agree on how to secure it.
A password for email, a website or another service: change it on that service and anywhere else you use the same password. End active sessions to sign out anyone logged in on other devices. Check for unfamiliar devices or apps connected to the account, and enable two-factor authentication if you have not already done so.
Identity document details: for example, in Poland place a restriction on your PESEL number through the mObywatel app, at www.mobywatel.gov.pl or at your local municipal office.
Money: if you transferred money to a scammer or notice an unauthorised payment, contact your bank immediately. Report the loss to the police too.
If a work account or company information is involved, notify the person responsible for IT immediately. If a criminal takes over your social media profile, warn your friends through another channel: the attacker may impersonate you to try to get money from them.
It is worth reporting suspicious messages and websites even if nothing has been stolen. In Poland, use the form at incydent.cert.pl and forward suspicious text messages to 8080. Your report can help protect other people from the scam.
Phishing protection at a glance: what should you remember?
When someone asks you for money or information, or to do something unusual, keep these rules in mind:
do not treat a familiar sender name, correct grammar or a website’s appearance as proof that it is genuine,
do not enter information on a suspicious website: check its domain and resolve the matter through a familiar app or a contact you trust,
verify requests for transfers, changes to bank details or confidential information through a different channel from the one the request arrived on,
before using a code or approving an action, read what the confirmation is for,
secure sign-ins to important accounts and keep your software up to date,
if you share information with a scammer, act immediately rather than waiting for visible consequences.
Time pressure is a reason to be more cautious. It is better to verify a request before making a transfer than to try to recover the money afterwards.
If you need help securing your own devices or your company’s computers, get in touch. We will check which operating systems you use, help you choose suitable protection and assist with the setup.
