A parcel notification stating that you need to pay customs duty. A letter from your bank stating that unusual login activity has been detected. A message from your ‘web hosting provider’ stating that your email account is about to expire. An email from a supplier stating that their bank account number has changed. Phishing remains the most common method today for someone to steal passwords, credit card details or money, and the attacks are becoming increasingly convincing: emails written using artificial intelligence arrive in flawless Hungarian and are personalised to the recipient.

In this guide, we’ve put together information on how to recognise phishing messages, what technical settings you can use to protect your business email and domain, how to make your accounts resistant to stolen passwords, and what to do if the worst has already happened. You’ll also find a checklist at the end.

What is phishing?

Phishing is a type of fraud in which the attacker poses as a trustworthy entity (a bank, courier service, government department, service provider, colleague or manager) to trick you into doing something: clicking a link, entering your password, opening an attachment or transferring money. It does not exploit software vulnerabilities, but rather human inattention, haste and deference to authority. Our knowledge base article also discusses phishing emails.

The most common forms

• Mass email phishing: generic emails sent to large mailing lists, purporting to be from banks, courier services, online shops, utility companies or government departments.
• Targeted phishing (spear phishing): an email addressed to a specific individual, based on information gathered about the company, their role and their colleagues, and is therefore much more credible.
• CEO fraud (whaling) and business email compromise (BEC): the attacker requests an urgent bank transfer or provides a ‘new bank account number’ in the name of a senior executive or a supplier. They often write from a genuine, previously compromised email account, continuing an existing thread of correspondence.
• SMS phishing (smishing): SMS messages claiming you have a ‘debt’ relating to a parcel notification, a banking alert, a fine or a road toll, containing a shortened link.
• Telephone fraud (vishing): the caller pretends to be a bank security officer, a police officer or an IT specialist. Using a voice cloned with artificial intelligence, they can even imitate the voice of a familiar colleague or manager, and there have even been cases of fake video calls.
• QR code phishing (quishing): the link is embedded in a QR code, in an email attachment, on a parking meter or on a leaflet, so it is not detected by the email system’s link filter, and the address is more difficult to verify on a mobile phone.
• Fake login pages: exact copies of the login pages for Microsoft 365, Google, your bank, Ügyfélkapu+ or your web hosting provider, hosted on a domain with a similar name.

What has changed in recent years?

The warning signs of the past – poor spelling and traces of machine translation – are becoming increasingly rare: with language models, anyone can write flawless, personalised text in any language. Attackers have also learnt to circumvent even the simplest forms of two-factor authentication: a man-in-the-middle phishing site steals not only the password but also the access code and the logged-in session. That is why advice such as ‘watch your spelling’ is no longer enough; protection must also include technical layers.

Video: Phishing kisfilm (Nemzeti Kiberbiztonsági Intézet, in Hungarian)

How can you spot a phishing message?

A single sign on its own isn’t proof, but if several apply to a message, be very careful.

1. Pressure and threats. “We’ll suspend your account within 24 hours”, “final warning”, “pay immediately”. The aim of this rush is to stop you from thinking twice about what you’re doing.
2. An unexpected request. You’re not expecting a parcel, you haven’t ordered anything, you haven’t asked for your password to be reset, yet that’s what the email is about.
3. The sender’s address is incorrect. The name displayed (‘OTP Bank’, ‘aWh support team’) could be anything. Check the actual email address and domain: a free email address, a strange domain or a single-letter difference (rn m, 1 l, .co .com) is a tell-tale sign.
4. The link points elsewhere. Before you click, hover your mouse over it (or press and hold on your phone) and check the actual address. The domain is the key part – that is, the part immediately before the extension (.hu, .com): bank.hu.ellenorzes-online.com does not belong to bank.hu.
5. It asks for a password, code or card details. Banks, service providers or government agencies will never ask for a password, one-off code or full card number via email, text message or telephone.
6. An unexpected attachment. An invoice, delivery note or ‘scanned document’ from a stranger or an acquaintance, but in an unusual format. Files with extensions such as .zip, .iso, .img, .html, .htm, .exe and .js, as well as Office documents that prompt you to enable macros, are particularly suspicious.
7. Changes to payment details. If a partner emails you asking you to transfer funds to a new account number, this is one of the most common steps in CEO fraud and BEC. Always verify this by calling a previously known telephone number.
8. An unusual tone from an acquaintance. A colleague suddenly starts using the formal ‘you’ or is being overly familiar; at other times they’d never ask for a gift card, but now they have.

The padlock does not guarantee reliability. The padlock visible in the browser’s address bar simply means that the connection is encrypted; it does not mean that the site is genuine. The vast majority of phishing sites now operate with free SSL certificates. Always check the domain.

The safest method is this: do not click on the link in the email; instead, open the provider’s website or app yourself (either via a bookmark or by typing in the address) and check there to see if you really need to take any action. If you receive a phone call, hang up and call the provider back using their official number that you know.

Technical protection for your domain: SPF, DKIM and DMARC

In its original form, email does not verify the sender’s identity: anyone can send an email on behalf of your domain. Three rules configured in the DNS allow you to verify this, and by using them, you can make it more difficult for emails purporting to be from your company to reach your customers and partners.

• SPF: specifies which servers are authorised to send emails on behalf of the domain. The receiving server uses this information to verify that the email originated from an authorised server. In detail: What is an SPF record?
• DKIM: your mail server adds a digital signature to outgoing emails; the recipient uses the public key published in the DNS to verify that the email was indeed sent by your server and has not been tampered with en route. In detail: What is a DKIM record?
• DMARC: tells the receiving server what to do with emails that arrive on behalf of your domain but fail SPF and DKIM checks: do nothing (p=none), place them in the spam folder (p=quarantine) or reject them (p=reject). You can also request reports on who is sending emails on your behalf. In detail: What is a DMARC record?

Major email providers already require this: Google and Yahoo from February 2024, and Microsoft (Outlook.com) May 2025, have required senders of large volumes of emails to use SPF, DKIM and DMARC, and emails without authentication are increasingly being sent to the spam folder or rejected. Configuring these settings therefore not only protects against phishing, but also improves the delivery of your own emails.

The recommended order is as follows: configure SPF and DKIM for all services that send emails on behalf of your domain (including not only the mail server but also the newsletter sender, online shop and invoicing software); start DMARC with the p=none setting; monitor the reports for a few weeks; then tighten the settings to quarantine; and finally to reject. We’ve outlined these steps in our DMARC setup guide. On aWh cPanel hosting accounts, SPF and DKIM can be configured in the ‘Email Deliverability’ menu with just a few clicks; if you get stuck, drop us a line and we’ll help you out.

SPF, DKIM and DMARC protect your domain against impersonation. Emails sent from a domain with a similar name (such as awh-hu.com) will not be blocked, so users need to be vigilant and filter their incoming emails.

Filtering incoming emails

The mail server’s spam filter blocks the majority of mass phishing emails, whilst the antivirus scanner detects infected attachments. All aWh hosting plans that include email services come with spam filtering. You can further improve this with a few settings:

• Adjust the sensitivity of your spam filter to suit your own email habits, and check your spam folder from time to time to ensure your genuine emails don’t get lost.
• Set up a filter to flag emails that appear to be from an internal colleague but are actually from an external sender, or messages containing suspicious attachments.
• Don’t disable the phishing warnings in your email client and browser.

A knowledge base article explains how spam filtering works, why legitimate emails might end up in the spam folder, and what to do about emails that end up in the spam folder.

Account security: if your password does get leaked

Sooner or later, someone will click on a malicious link. The aim is to ensure that a stolen password alone is not enough.

• Two-factor authentication (2FA) everywhere: in your email, on the hosting control panel (here’s how to enable it in cPanel), in your customer account, in the WordPress admin panel, with your bank and on social media.
• Ideally, use a phishing-resistant method: the passkey and the hardware security key (FIDO2) only work on the genuine domain, so they cannot be phished from a fake site. Where available, use this. If not, an authentication app (TOTP code) is much better than nothing, whilst an SMS code is the weakest option, but still better than a password alone.
• Password Manager: generates unique, long passwords for every site and only fills them in automatically on the genuine domain. If the Password Manager does not suggest a password on a site, this is a cause for concern.
• Don’t use the same password in multiple places. If it’s leaked from one provider, attackers will automatically try it elsewhere too.
• Approving push notifications: never approve a login that you did not initiate yourself, even if you receive multiple requests in quick succession.

Processes within the company

Financial fraud causes the most damage; the best way to prepare for this is through organisational policies.

• The ‘four-eyes’ principle: any large transfer or change to a partner’s bank account number must always be approved by two people.
• Call back using a known number: always verify changes to your bank account number or urgent transfer requests using a previously known telephone number, not the one provided in the email.
• There are no ‘secret, urgent’ exceptions: fraudsters often ask you not to tell anyone, claiming it is a confidential matter. Make it clear that the usual checks still apply in such cases.
• Simple reporting procedure: make it clear who to contact if someone has received a suspicious email or clicked on a link. Don’t penalise those who report it quickly: early reporting significantly reduces the damage.
• Regular training: short sessions with practical examples, held several times a year. The simulated phishing emails clearly show where the team stands.
• Updates and backups: ensure that your operating system, browser and programs are up to date, and keep a backup stored separately from your computer, as a phishing email often contains ransomware.

Protecting your domain and brand

Attackers often use your company as bait: they send emails to your customers from addresses similar to your domain. You can make this more difficult by:

• Set DMARC to the reject level to prevent your exact domain from being spoofed,
• Register the most common misspellings and extensions (we’ve covered this in our guide to choosing a domain),
• Make it clear on your website and in your emails that you will never ask for passwords or card details via email,
• Make sure you enable two-factor authentication on the accounts you use to manage your domain and DNS as well, because anyone who changes your DNS settings could also hijack your email.

What should you do if you’ve already clicked?

1. Don’t panic, but act quickly. The sooner you take action, the less damage there will be.
2. If you have entered a password: change it immediately (using another, secure device) and anywhere else where you have used the same one. Log out of all sessions and check that the attacker has not set up a forwarding rule or an automatic reply in your mailbox.
3. If you have provided credit card or bank details: call your bank’s official number – which can be found on the back of your card or on the bank’s website – immediately and block the card. Banks maintain a helpline for this purpose that is available round the clock.
4. If you have opened an attachment or installed a program: disconnect the computer from the network and contact your system administrator or a specialist. Run a full virus scan.
5. If this concerns a business account, please inform your company’s IT specialist or manager. If personal data may have fallen into the wrong hands, this may constitute a data protection incident, which must be reported to the NAIH within 72 hours; we have written about this in our data protection guide.
6. If you’ve lost money too: report it to the police and notify your bank as soon as possible; a recent transfer can sometimes still be reversed.

How do you report phishing?

• In your email client: Gmail, Outlook and most webmail services feature a ‘Report Phishing’ button, which you can use to train the service provider’s filters.
• For the impersonated organisation: banks and larger service providers usually publish an address to which you can forward fraudulent emails sent in their name.
• The National Cyber Security Institute (NKI): In Hungary, the NKI receives reports of cyber security incidents and phishing websites.
• To the Google Safe Browsing service: by reporting fake websites here, browsers will warn other visitors.
• To the police: if damage has occurred.

Anti-phishing checklist

To everyone

• I check the actual URL before clicking on a link; I only enter my password on pages I have opened myself.
• Two-factor authentication is enabled on all important accounts, using a passkey where possible.
• I use a password manager, with a unique password for every site.
• My phone, my computer, my browser and my programs are all up to date.
• I know who to contact and how to report it if I’ve received or clicked on a suspicious message.

The company

• SPF and DKIM are configured on the domain for all sending services, whilst DMARC is set to at least quarantine level, with the aim of achieving reject.
• Email is subject to spam filtering and malware scanning.
• We verify changes to bank account numbers and large transfers using call-back procedures and the four-eyes principle.
• Staff receive short, practical training sessions several times a year.
• The control panels for domains, DNS, hosting and email are protected by two-factor authentication.
• We have a tried-and-tested backup system that is separate from our machines and servers.
• We have a written plan detailing what we do following a successful phishing attack.

Summary

There is no single magic bullet against phishing, but with multiple layers of protection, the risk can be reduced to a minimum. The technical layer (SPF, DKIM, DMARC, spam filtering) filters out the majority of attacks; two-factor authentication and password management ensure that a stolen password alone is not enough; and well-established company procedures prevent financial fraud. The most important rule, however, is simple: if a message is urgent and asks for a password, code or money, stop and verify it via another, trusted channel.

aWh’s email hosting and hosting plans include spam filtering, encrypted connections and two-factor authentication to help keep you secure, and we’ll assist you in setting up SPF, DKIM and DMARC in Hungarian. If you have any questions, please get in touch.

Frequently Asked Questions

How can I be sure that an email is a phishing attempt?

Definitely not – so the best approach is not to use the link or phone number provided in the email. Go to the provider’s website or app yourself, or call their official number, and check there to see if you actually need to take any action. Signs to watch out for include urgency, unexpected requests, a different sender address or link, messages asking for your password, code or card details, and a changed bank account number.

What is the difference between spam and phishing?

Spam is unsolicited advertising or bulk email that is annoying but does not usually set out to deceive. Phishing emails are based on deception: they pose as a trustworthy entity in order to trick you into handing over your personal details or money.

Is a good antivirus program enough?

No. Antivirus software protects against malicious attachments, but it can do nothing to prevent a password being entered on a fake login page. Two-factor authentication, a password manager, domain authentication (SPF, DKIM, DMARC) and vigilant users all combine to provide good protection.

If there’s a padlock on the page, is it secure?

The padlock simply means that the connection is encrypted; it does not mean that the site is genuine. Most phishing sites now operate with a valid SSL certificate. Always check the domain name.

I use a free email service. Can I set up SPF and DKIM there too?

The provider handles the domain verification for a free email address (such as @gmail.com); you don’t need to do anything, but you cannot use your own domain with it. If you use your own domain for email, you will need to configure SPF, DKIM and DMARC in your DNS settings, or your web hosting provider can assist you with this.

How can I protect myself against CEO fraud?

In accordance with organisational rules: large transfers and changes to bank account numbers must be approved by two people, and every such request must be verified via a previously registered telephone number, even if the request comes from a manager and is marked as ‘urgent and confidential’.

What should I do if I’ve clicked on a link but haven’t entered anything?

Close the page; do not download or open anything. In a modern, up-to-date browser, a single click rarely causes any harm, but run a virus scan, and if you’re using a work computer, tell your IT support. If the link has started a download, do not open the file.

Is there such a thing as 100 per cent protection?

No. The aim is to reduce risk through multiple, complementary layers of protection, and to have a plan in place in case something does go wrong. Those who detect and report an attack quickly will suffer less damage.

• phishing
• cybersecurity
• email delivery
• authentication
• guides