A phishing email is a fake message sent in the name of a well-known company, organisation or individual, with the aim of tricking you into revealing your password, credit card details or other personal information, opening an attachment containing malware, or transferring money to the fraudster’s account.

Common forms

• Bank or card issuer: “suspicious transaction”, “we have blocked your account”, and the link takes you to a copy of the bank’s login page.
• Parcel delivery: “Your parcel is awaiting customs clearance”, “Please pay a delivery charge of 500 Ft”. The aim is to obtain your card details.
• Service provider notifications: “Your domain is about to expire”, “Your mailbox is full”, “We are suspending your hosting account”. The link leads to a fake webmail or client portal login page. These emails specifically target website and domain owners.
• Fake invoice or change of account number: it is sent on behalf of a partner or supplier and asks you to transfer the next invoice to a new bank account.
• Management instruction: on behalf of the company director, request an urgent, confidential transfer or the purchase of a gift card.
• Targeted attack: the email mentions your name, job title or a genuine project, which is why it appears particularly credible.

How can it be identified?

1. Urgency and threats: ‘within 24 hours’, ‘immediately’, ‘otherwise it will be deleted’. Genuine service providers rarely write like this.
2. The sender’s address: the name displayed may be ‘OTP Bank’ or ‘aWh support team’, but the address behind it is an unfamiliar or misspelt domain. Click on the sender’s name to view the full address.
3. How to check a link: hover your mouse over the link (or hold your finger on it on a mobile) and view the actual URL. A domain such as bank-hu-login.xyz or similar is a tell-tale sign.
4. Logging in via email: never enter your password via a link; open the provider’s website from your own bookmarks or by typing the address into the address bar.
5. Attachment: HTML, ZIP or ISO files, or Office documents requesting permission to run macros, are suspicious if received unexpectedly.
6. QR code: if the email asks you to scan a QR code, the same rule applies as for the link.

Spelling mistakes are no longer a reliable indicator of authenticity: fraudsters use translation software and artificial intelligence to produce flawless Hungarian text.

What should you do if you receive a suspicious email?

• Do not click on any links, do not reply, and do not open any attachments.
• If the email appears to be genuine, verify it via an independent channel: call the bank or partner using a number you know.
• Mark the email as spam or a phishing attempt in your email client, and inform your colleagues if your company is being targeted.

If you have already clicked or entered your details

1. Change the affected password immediately, and wherever else you have used the same one.
2. If you have provided your credit card details, please contact your bank and block the card.
3. Enable two-factor authentication wherever possible.
4. Check your email account’s forwarding rules and filters, as attackers often leave traces there.
5. If you have opened an attachment, please run a virus scan.

How can you protect your own domain?

Fraudsters may also use your domain in the ‘From’ field. By configuring SPF, DKIM and DMARC records, receiving servers can recognise and filter out these emails. All three can be configured in our email hosting plans, and incoming emails are checked by a spam filter. Our blog post on phishing protection provides more detailed information on how to protect against phishing.