Phishing
A fake link that steals your password. A fraudster often does not even “hack” the account: they politely ask you to enter the password yourself. This article shows you how to spot such an attempt.
Phishing (from the word fishing) is when a fake email, SMS or site looks exactly like the real one and asks you to do something urgently: sign in, confirm, pay.
A phishing site today looks almost like the real one: the same logo, the same colours, the same text. So do not trust a page by its looks. Two things give the fake away: the site's address and the hurry.
The most important rule
In the address, look at the part written before the first “/”, and read it from the end. The last two parts (for example mybank.ge) are the real owner. If the bank's name appears in the middle of the address, and the end is .com, .info or an unfamiliar word, it is fake.
The four most common forms
They all ask for the same thing: a password or a code that you enter yourself.
1. By email
A fake email “from the bank”, “from the tax office” or from a delivery company. Inside is a link to a copy of the real site. Often a file comes with it: an “invoice” or a “receipt”.
2. By SMS
“Your parcel is on hold, pay $2” or “Your card is blocked, follow the link”. In such an SMS, do not tap the link: check the parcel's status on the company's official site.
3. By phone call
A “bank employee” calls and asks for the SMS code “to protect your account”. A bank never does this.
4. By ads and QR codes
A paid ad on social media that opens a fake site. Also a QR code on a table or in a car park. After scanning, first read the address, and only then open it.
How to spot a fake address in 10 seconds
- Look at the address, not the designA design can be copied in an hour, an address cannot. A logo and colours are not proof.
- Find the real domain
mybank.ge.secure-login.info— here the real owner issecure-login.info;mybank.geis only there to fool the eye. - Check for an extra hyphen or a changed letter
mybank-ge.comandmybank.geare different sites. Letters are often swapped: the digit0instead ofo,rninstead ofm. - Do not tap the link — go there yourselfClose the email, open the browser and type the address yourself, or open the bank's official app.
Unsure about a link? Paste it into Horkos. We will check whether it imitates a well-known brand, how old the domain is and whether it is on lists of phishing sites.
How to spot a fake email
The text may be flawless, but the tone and the situation always give something away.
Suspicious
- “Urgent!!!”, “Blocked within 24 hours”, “Final warning”
- They ask for a password, PIN or SMS code
- One letter in the sender's address is changed
- The email is unexpected — you did not ask for anything
- Grammar mistakes, a foreign currency
- A file they ask you to open “urgently”
What a real organisation does
- Never asks for a code, PIN or password
- Asks you to sign in to the app yourself
- If in doubt, call the official number that you found yourself
Two-factor authentication (2FA)
One setting that makes most phishing attempts fail.
Two-factor authentication (2FA) means that signing in needs one more code after the password. This code appears on your phone. If your password is stolen, they still cannot get in.
How to turn it on
1. Open your account settings. 2. Look for “Two-Factor Authentication” or “2-Step Verification”. 3. Choose an app (for example Google Authenticator) instead of SMS. Turn it on for your email, your bank and your social media.
If you have already entered your password
Panic does not help; speed helps a lot.
- Change the password right nowFirst your email's, then the account whose password you entered. If you use the same password elsewhere, change it there too.
- Turn on two-factor authenticationIf the fraudster has already signed in, changing the password alone may not be enough.
- Check what is happening on the accountLook through recent payments, the sign-in history and sent messages. Fraudsters often change the recovery email or phone number.
- If you entered card details, block the cardCall the number on the back of the card and ask for a new card.
- Warn the people you knowIf links were sent from your account, tell people not to tap them. The other steps: if you have already been scammed.
Test your knowledge: Test — Phishing
Frequently asked questions
The site has a padlock (HTTPS). Does that mean it can be trusted?
No. The padlock only means the connection is encrypted. It says nothing about who owns the site. Most fraudulent sites have a padlock today too.
The email came from a familiar name. Does that mean it is real?
No. Any name can be written as the sender. Look at the part after the @: that is exactly who the email came from.
I opened the link but did not enter anything. Is that dangerous?
Often just opening it is not enough to steal an account, but the site may ask you to download a file or to allow “notifications”. Close the page, download nothing and do not give permission.
Why an app and not an SMS code?
Fraudsters sometimes move your number to another SIM card, and the SMS codes then go to them. An app code is created on your phone and cannot be stolen this way.
The fake page looks exactly like the real one. How do I spot it?
Often you cannot tell by its looks — that is why phishing is dangerous. You spot it by the address, and by whether you opened the page yourself or came through a link. You can check a link in Horkos.
This article is for information only. It does not replace legal or financial advice.