Phishing 2026: how you can still recognise fake bank emails

A few pretexts recur: an allegedly blocked payment, an expiring verification, a new security procedure, an unusual login. What they all have in common is that they suggest an immediate action and offer a route for it — a link, a telephone number, an app approval.

Notable is the trend towards a change of medium. The e-mail announces a call; the call refers to an approval in the banking app. Each individual step thereby appears confirmed, even though all the steps come from the same source.

No bank requests a TAN, PIN or passwords by e-mail, SMS or telephone. Nor is it required that money be transferred to another account for security, or that an approval be given in the app whose text does not match the described transaction. The displayed approval text is the decisive detail: it describes what is actually being authorised.

It is regularly advisable to inform the bank immediately via the official blocking number, to block access and to change passwords from another device. Secure the message, sender address, headers and telephone numbers; they are required for information requests and a criminal complaint.

Whether a payment can be recovered depends on the payment route and the lapse of time. In the case of authorised payments — for example after an approval has been given — the starting position is to be assessed legally differently from unauthorised ones. A review may be required.