Specialisms
A message looked like one from your bank – and took your credentials with it.
Phishing is not aimed at technology, but at a brief moment of plausibility: a message in the familiar layout, a comprehensible occasion and time pressure that prevents reflection. After that, speed counts above all – in blocking access, in the conversation with the bank and in securing what can later prove the sequence of events.
Circumstances
Clarify the context
Evidence
Preserve documents
Deadlines
Explain any urgency
Approach
Discuss the next steps
Immediate steps
The first hours after an approval
The following steps are practical in nature and are sensible in this order. They do not replace a review of the individual case, but they preserve options that otherwise close within hours.
Have access blocked immediately
Call your bank and have online banking, cards and mobile payment methods blocked. The email account is frequently also affected if the same password was used there – without blocking it, confirmation emails continue to arrive on the other side.
Expressly ask for a recall of the payment
Do not ask only for a block, but expressly for a recall of the executed transfer or a chargeback in the card procedure. Have the date and time of your report confirmed in text form. Time limits apply to such procedures that can be short and therefore need to be clarified at once.
Secure the evidence before you tidy up
Keep the original message with complete headers – a screenshot alone is not enough for that – together with the address that was opened, captures of the forged page, the transaction data, and the date, time, telephone number and content of every call. Delete nothing, including later contact attempts.
Change passwords from another device
Change the passwords of all accounts that used the same combination, and do so from a device that was not affected. At the same time check the devices, sessions, forwarding rules and telephone numbers stored in the accounts and remove everything you did not set up yourself.
File a criminal complaint
A complaint to the police is free of charge and produces a file number that banks, payment-service providers and insurers regularly require before they will examine a matter. Take the secured documents with you; a later supplement is possible.
No further approvals – not even for an alleged recovery
A successful attack is frequently followed by a second: callers pose as the bank, investigators or a recovery service and again demand codes, remote access to your computer or a transfer to a “security account”. No institution and no authority requires that. End such conversations and document them.
Contact & appointments
Switzerland
Zürich
United Kingdom
London
Estonia
+372 6 288 2000
France
+33 2 04 26 81 82
Netherlands
+31 970 102 51606
Germany
+49 30 41733313
WhatsAppMessage us directly
Send a WhatsApp messageOverview
How phishing actually unfolds
It begins with a message that imitates a familiar sender: the house bank, a parcel service, a tax authority, an energy supplier, occasionally also the company’s own IT department. The occasion is always one that cannot be ignored – an alleged security check, a payment that cannot be allocated, a threatened block. The link it contains leads to a replica login page that is barely distinguishable from the genuine one. What is entered there is in the perpetrators’ hands at the moment it is typed.
The second step is frequently a telephone call. A person posing as a member of the fraud department confirms the message, speaks of an ongoing attack and asks for an approval in the banking app or a transfer to a “security account”. The decisive act is thereby performed by the person affected themselves. It is precisely at this point that the later dispute with the institution that treats the transaction as authorised begins.
The consequences extend beyond the one payment. With the data obtained, stored contact details are changed, cards are registered for mobile payment services, spending limits are raised or loans are applied for. Even if no money has left the account, the data outflow remains relevant: it can form the basis for later contracts concluded in the name of the person affected and makes them a preferred target for the next call.
Recognising the signs
How forged messages become recognisable
The design is now clean, and spelling mistakes are no longer a reliable indicator. The following points are more robust and can be checked in a few seconds even under time pressure.
- The sender address differs in a detail – an extra hyphen, a different ending, a swapped letter.
- On hover, the link leads to an address that has nothing to do with the displayed text.
- The message sets a very short deadline and announces a block, a fee or a chargeback if you do not act at once.
- You are to log in via an enclosed link instead of via the address or the app you otherwise use.
- A call confirms the message shortly afterwards – frequently from a number that appears on the display as belonging to your bank.
- A TAN, an approval code or a confirmation in the app is demanded for a transaction that you did not initiate yourself.
- The approval text on your device names a different amount, a different recipient or a different purpose from what you are told on the telephone.
Possible measures
Possible measures
Which steps come into consideration depends on the payment channel, on the timing and on the precise course of the approval. We tell you in advance what a step costs and what it can realistically achieve.
Minute-by-minute reconstruction of the sequence
Who was shown what, and when, and what was heard on the telephone, is the core of every later dispute with the institution. We record the sequence in a structured way while the recollection is still fresh and match it to the documents.
Correspondence with the bank and the payment-service provider
We draft the reimbursement and chargeback requests, identify the payments in detail and observe the applicable time limits. A right to information against the payment-service provider may also come into consideration, in order to trace the further path of the funds.
Review of the allegation of gross negligence
Institutions frequently rest their refusal on the assertion that the approval was given with gross negligence. Whether that allegation holds depends on what was actually displayed on the device and how the deception was constructed. A review of this question may be required before the refusal is accepted.
Pursuing the recipient side
Destination accounts frequently lie with institutions or payment-service providers elsewhere in Europe and are forwarded within hours. Depending on the timing, information and protective measures may come into consideration there; whether funds are still present cannot be established in advance.
Criminal complaint and coordination with the investigation
We prepare the complaint so that the payment channels are intelligible for the investigative authorities, and we time civil-law steps to match so that they do not obstruct one another.
Protection against consequential harm
With data that have flowed out, contracts can later be concluded or accounts opened. Depending on the extent of the outflow, it may be advisable to inform credit-reference agencies, to arrange blocking notices and to review one’s own data holdings.
Prospects
How the prospects are to be assessed
Whether a payment can be recovered is almost always decided by where it has gone and who holds it at that moment. If the amount is still on the recipient account, a recall can succeed. If it has already been forwarded, withdrawn in cash or exchanged into crypto-assets, the options narrow considerably. The result cannot be promised in any of these cases, and no one who makes you such a promise can keep it.
Some paths close faster than others. Recall and chargeback procedures are bound to time limits that differ by payment type and are in some cases very short; they should therefore be clarified at once. The dispute with one’s own institution over whether a payment is to be treated as authorised remains open longer by comparison, but requires a reliable reconstruction of the sequence.
What we can promise is an honest assessment: which steps remain open in the concrete case, what they cost and where the effort is out of proportion to the result that can be achieved. The cross-cutting topics – preservation of evidence, payment tracing and the interplay of civil and criminal law – are set out in detail in the Fraud & Scam practice area.
Frequently asked questions
Frequently asked questions after a phishing attack
The answers set out the general framework. What applies in your case depends on the payment channel, on the timing and on the concrete course of the approval.
Related specialisms
Patterns that often overlap
Fraud rarely follows just one pattern. If your case only partly matches, related specialisms may help you understand the connections.
Identity theft
Misuse of personal data for contracts and accounts – defence against claims, information requests and correction of entries.
Find out moreFake websites
Counterfeit brand and government sites – evidence preservation, reports to registrars and protection of your own brand.
Find out moreCybercrime
Data theft, ransomware and attacks on corporate networks – preservation of evidence, notification channels and possible claims.
Find out more
Related information
Related information
- Fraud and scamsWhen fraud is suspected, payment routes, correspondence and timing are important starting points.
- Recognising signs of fraudUrgency, secrecy and extra payments before a promised withdrawal are recurring warning signs. A single feature does not replace examination of the facts.
- Fraud patterns at a glanceForged invoices, fabricated relationships and manipulated investment platforms follow different patterns. Explore how they work and possible next steps.
- Contact usDescribe your matter in a few sentences. Include only what is needed for the initial contact. Documents can be requested later through a suitable channel.
Contact
Describe your matter
An enquiry does not establish a client relationship or responsibility for monitoring deadlines. If a deadline is approaching, do not rely on this form alone.
- General information. The legal assessment depends on the circumstances of each case.