Exercise: How to recognize a fake e-mail from a bank?
The purpose of this exercise is to learn how to distinguish between real messages and scams, known as phishing. Always pay attention to the details, as scammers often use small mistakes to phish your data.
Example: Real email from the bank
Sender: info@mojbank.pl
Topic: important information regarding your account
Content:
Dear Customer,
We would like to inform you that we have recently introduced new security features in the online banking system. For details, please log in to your account via the bank’s official website.
Remember, we never ask for passwords, card numbers or PINs in emails.
Sincerely, My Bank Team
Example: Fake e-mail (Phishing)
Sender: mojbank-weryfikacja-pilna@support.pl
Subject: urgent account verification!!! – Your account will be blocked
Content:
Dear Customer,
Your account requires immediate verification due to suspicious activity. Ignoring this message will result in the blocking of your funds.
To verify, click on the following link: https://www.moj-bank.pl.pl/logowanie (note the extra .pl!)
IMPORTANT: Log in immediately to avoid account lockout.
Yours sincerely, Verification Department
What are the differences? What to look out for?
- Sender’s email address: A real bank sends messages from an official, short and easy-to-remember domain (e.g. @mojbank.co.uk). Fake e-mails often come from strange, long addresses (e.g., mojbank-weryfikacja-pilna@support.pl) or contain errors.
- Message subject: Scammers always apply pressure, using words such as “URGENT,” “IMMEDIATE,” “BLOCK ACCOUNT.” Real banks use calmer language.
- Message Content:
- Language errors: Fake e-mails often contain spelling and grammatical errors (“for the sake of”, “suspicious activity”, “with regards”).
- Pressure to rush: Scammers want you to act quickly and under the influence of fear, rather than calmly.
- Asking you to click on a link: A real bank never asks you to log in via a link from an email. Always go to the bank’s website by typing the address manually in your browser.
- Content of the link: Always hover your cursor over the link (without clicking on it!) to see where it actually leads. A fake link may look similar, but contain minor differences, such as typos (e.g. mojbankk.pl), extra words (mojbank.pl.pl) or special characters.