Check first. Then act.
The account is about to be blocked. A parcel supposedly needs another payment. An important document is waiting, but it must be opened immediately.
Messages like these are designed to make us react quickly. In phishing, criminals use fake messages, calls or websites to obtain confidential information, trigger payments or spread malicious software. The UK's National Cyber Security Centre describes these methods in its consumer guidance. [1]
I do not find it particularly helpful to tell people afterwards that they should have been more careful. The more useful question is which habits, technical safeguards and clear procedures can prevent a convincing message from causing harm.
My most important principle is this: a message may claim that something is urgent. I decide whether to act only after checking independently.
Do not rely on spelling mistakes
Poor wording, unusual senders and inappropriate logos may stand out. Their absence is not an all-clear.
Germany's Federal Office for Information Security (BSI) explains that phishing messages can be difficult to recognise. AI can also help produce convincing wording. A well-written message is therefore not proof of a legitimate sender. [2]
I would focus on the action being requested. Why do I need to sign in again right now? Why does someone need a security code? Why must a payment suddenly take place outside the normal process?
These examples deserve an additional check:
An account will supposedly be blocked within a few hours: is there a matching notification in the customer account I have opened myself?
A message requests a password, security code or unexpected approval: did I actually initiate this process?
An unexpected document requires another sign-in: has the known contact really sent anything?
A payment must suddenly go to another bank account: has this change been confirmed through an established contact method?
A message demands secrecy or forbids questions: why should the normal checks be bypassed?
Pressure, impersonated authority and unusual demands are among the warning signs described by the NCSC. They are reasons to investigate, not individually conclusive proof of fraud. [1]
The more reliable check happens outside the message
With a questionable account warning, I would not use the supplied link. I would open the already installed app or enter the familiar website address myself.
This lets me check the claim without allowing the message to choose my route to the sign-in page. The BSI recommends avoiding suspicious links, checking the browser address and not disclosing confidential login details in response to questionable requests. [3]
If a call is necessary, the number should come from an independent source, such as existing contract documents or the customer account opened independently. Germany's consumer advice organisation Verbraucherzentrale likewise recommends not relying on the contact details in a suspicious message. [8]
Replying to the same email would not be independent confirmation. It would simply continue the original communication channel.
This does not mean ignoring every unexpected message. A genuine invoice or security warning can matter. The important point is to verify its content through another trustworthy route.
A padlock in the browser does not confirm the provider
Even a fraudulent website can use an encrypted connection.
HTTPS describes the connection between the browser and the website. It does not automatically confirm that the website belongs to the bank, parcel company or business whose design it imitates. The Chromium project explicitly explains this distinction. The browser symbol can vary; the principle is the same. [12]
I would therefore not trust a familiar logo or design alone. For an unexpected sign-in request, going through the known app or address is the more useful check.
Phishing also arrives by text, letter or QR code
Not every fraud attempt arrives in an email inbox. Text messages and phone calls can also be used to deceive people. [1]
QR codes create an additional problem: the destination cannot be read directly from the printed pattern. In its guidance on 'quishing', Verbraucherzentrale describes fake bank letters and codes pasted over legitimate ones at charging stations and parking machines. [4]
A printed letter is not automatically more credible just because it arrived by post. A QR code is not a security seal; it is initially just a way of retrieving information or opening an address.
Before opening a website, check the destination address in the scanner's preview. Not every camera or scanner shows this automatically. If yours opens websites immediately, use a reputable scanner that offers a preview, or a known alternative route. For a questionable code, I would use the provider's familiar app, an existing payment card or another confirmed payment method. A visibly covered or manipulated code is another reason to stop. [4]
For me, the same rule applies as with email: what matters is a verifiable origin, not the most convenient shortcut.
Secure accounts so that one mistake does not put everything at risk
Being attentive matters. It should not be the only safeguard.
Use a separate password for every account
The BSI recommends a unique, secure password for each online account. A password manager can help manage them. This limits the risk that a password stolen in one place immediately opens other accounts as well. [5]
However, a strong password cannot prevent you from accidentally entering it on a fake website. Secure sign-in and deliberate checks therefore belong together.
Use additional authentication factors
Multi-factor authentication requires another form of verification alongside a password. It makes unauthorised sign-ins harder, but not every implementation offers the same protection against phishing. The US Cybersecurity and Infrastructure Security Agency (CISA) explicitly distinguishes conventional methods from phishing-resistant authentication. [6]
I would not approve an unexpected request merely to make the notification disappear. Nor would I give a security code to someone who contacts me unsolicited and claims to be a support representative.
Consider passkeys
Where available, passkeys are an important alternative. They are bound to the relevant service rather than providing a reusable password to an unrelated imitation website. CISA describes this protection for FIDO/WebAuthn authentication; the BSI also explains the security benefits of passkeys. [6]
That does not mean protection against every kind of fraud. Even with a well-secured account, I would still independently verify an unusual payment request.
Keeping operating systems, browsers and security software up to date also remains important. Updates complement account protection; they do not replace it. [5]
Businesses need more than 'Please be careful'
Business messages often combine time pressure, responsibilities and financial decisions. I would therefore design important processes so that a single convincing email cannot trigger a consequential change.
For example, I would accept a supplier's new bank details only after checking through an already established contact method. I would require a second approval for unusual payments.
The NCSC's organisational guidance recommends confirming important requests through a second communication channel. It also warns against relying entirely on employees' ability to recognise every fraudulent message. [7]
An easy reporting route is equally important. Everyone should know whom to contact about a suspicious message.
Anyone who accidentally clicks must be able to report it immediately. The NCSC notes that fear of blame can delay reporting mistakes. [7]
I would treat a quickly reported mistaken click as an opportunity to respond promptly, not as a reason to embarrass someone.
What if something has already happened?
What matters is the action that actually occurred. Opening a link, entering a password and running an unknown file are different situations.
You only opened a link
Do not enter any further information or approve anything. Close the suspicious page.
A click alone does not prove that an account has been taken over. However, it does not rule out harm either. Verbraucherzentrale recommends updating security software, checking updates and scanning the device for malware, with expert help if necessary. [8]
For a work device, also inform the responsible IT team. [9]
You entered a password or login details
Open the real service through an independent route and change the affected password immediately. If malware is also suspected, use another trusted device. Change reused passwords on the other affected accounts as well. [8][9]
Then check existing sessions and signed-in devices and sign them out where possible. For an email account, also check forwarding rules and filters: attackers can use these to keep reading messages. The NCSC describes these steps in its account recovery guidance. [9]
A password change alone should therefore not be treated as the complete resolution.
You entered bank details or authorised a payment
Contact your bank or payment provider immediately through a known contact method. Ask which accounts or cards need to be blocked and whether a payment can still be stopped or recalled. [8][10]
A successful recovery cannot be promised. This makes prompt reporting all the more important.
Preserve messages, payment records and existing screenshots. Germany's police crime prevention service also recommends filing a police report when fraud has occurred. You do not need to reopen suspicious links to preserve evidence. [10]
You ran unknown software or suspect malware
Do not use the affected device for further sign-ins or banking. Where there is a concrete suspicion of infection, disconnect it from the network and have it examined by a qualified person. The BSI lists network disconnection among the measures for dealing with malware. [11]
For a company computer, further action belongs with the responsible IT team. Reporting the incident first, rather than resetting the device on your own, would be part of an orderly response for me.
My conclusion: interrupt the process before damage occurs
I do not want to investigate every message down to its last technical detail. But I do want habits that help even when a forgery looks convincing.
That includes opening important accounts myself, independently confirming unusual requests and securing sign-ins with suitable methods. Businesses also need clear responsibilities and a reliable reporting route.
And if something does happen, the question should not be how embarrassing the mistake is. What matters is what must now be protected, blocked and checked.
A legitimate matter can be clarified through an independent route. Anyone who tries to stop me doing that gets neither my password nor my approval.
Scope and research
Research date: 9 October 2026. These recommendations provide general guidance and do not replace an individual investigation of a security incident.
Sources and further reading
Sources checked on 9 October 2026. An access date is not a source publication date. Some BSI and CISA pages could not be opened directly; the relevant recommendations were additionally checked through the original-source search index. The official BSI passkey episode replaces its unavailable cryptography page. Some sources are in German.
[1] NCSC: Phishing scams and spotting scams
Read source ↗
[1] NCSC: Phishing scams and spotting scams
Read source ↗
[2] BSI: Email security myths
Read source ↗
[3] BSI: Protecting against phishing
Read source ↗
[4] Verbraucherzentrale: Quishing and fraudulent QR codes
Read source ↗
[5] BSI: Basic IT security advice
Read source ↗
[6] BSI and CISA: Passkeys and multi-factor authentication
Read source ↗
[6] BSI and CISA: Passkeys and multi-factor authentication
Read source ↗
[7] NCSC: Phishing attacks: defending your organisation
Read source ↗
[8] Verbraucherzentrale: Recognising phishing and responding after a click
Read source ↗
[9] NCSC: Account recovery and responding to phishing
Read source ↗
[9] NCSC: Account recovery and responding to phishing
Read source ↗
[10] German police crime prevention: Responding to fraud
Read source ↗
[11] BSI: Malware
Read source ↗
[12] Chromium project: An Update on the Lock Icon
Read source ↗