Double phishing – the two-stage trap

With double phishing, fraudsters throw two lures at you in quick succession and hope that you'll bite.

You usually receive an SMS or e-mail first, allegedly from the post office or DHL, telling you that you still owe them a small amount of money or that you need to complete your address details. If you click on the link and enter your details, then – ZAP – you’re already caught on the scammers’ first hook. 

Now comes step two of the trap – shortly afterwards someone supposedly from your bank or card issuer calls you. Even the telephone number in the display is often correct. The person on the other end of the phone claims that the payment that has just been triggered is suspicious and must be stopped. To do this, you should read out the security code which is about to arrive in a text, or confirm the transaction in your banking app.

But #watchout: Anyone who reads out the code in the text or confirms the request in their banking app authorises the transaction - instead of preventing it!

Here’s how to protect yourself: 

• Never disclose SMS codes, card data or app authorisations. 
• End the conversation with the alleged bank employee immediately.
• If in doubt, enquire via official channels.
• Always question supposed urgency.