Fraud prevention

1. Phishing and smishing

You received an email from the swebdank.ee domain. Seems legit, right? But check it again. There’s a typo, but the scammer creates false trust by likeness to a real address.

By phishing and smishing for your data, a scammer aims to get access to your Internet Bank account or card details and get you to confirm transactions with your actual PIN.

• First, the fraudster sends you a text message or an email, urging you to act fast, claiming that there’s suspicious activity in the account, you must update your details immediately, or pay a courier’s fee. They could also display attractive ads in social media, invite you to participate in a prize draw, promise benefits from discounts, etc.
• Scammers use logos of banks and well-known brands, as well as similar email and website addresses.
• Once the victim has entered their details, the scammer may use them to commit fraud any time then or later.

How to prevent phishing?

• Never share your bank details, such as username, card details, or PINs with anyone. Real banks never ask for your personal information!
• When entering your PIN, make sure that you initiated the payment and that the details are correct (compare control codes). Keep in mind that PIN1 represents you and PIN2 is your signature.
• Never click on links if you feel unsure that they take you where they promise to take you. Be especially suspicious about links in text messages. Instead of using the link, long into the Internet Bank.
• Don’t open or download email attachments.
• Make sure the page is authentic. It’s essential to check that the website address is error-free. For example, correct Swedbank addresses begin with https://www.swedbank.ee. Also, make sure that the sender’s email ends with @swedbank.ee. Carefully check the spelling!

2. Investment scams

Keep in mind – if productivity sounds too good to be true, it’s probably not true. As a rule, investment scams, crypto scams, and pyramid schemes use strong emotions to target human weaknesses. Scammers aim to keep the victim on the hook by convincing them even if they become suspicious.

• For example, you see a profitable investment ad on social media. You fill in the form and someone contacts you to explain the scheme further. In case of love scams, the investment scheme is introduced by a love interest the victim met on a dating app.
• The scammer asks you to transfer the investment sum to an investment account (for example, on a cryptocurrency platform) that is under the scammer’s control. They may also ask you to make the transaction via foreign trading platforms. In this case, they ask the victim to register an account on a foreign platform and self-authenticate with a personal ID. This way, they get the hold of the victim’s personal information.
• Next, the scammer contacts the victim and shows a healthy profit, urging the victim to make new payments to increase the profit even further. The aim is to create excitement from a game of chance. For example, they ask to transfer money at a specific time, wait for a letter, or upgrade to an even more profitable level. In a pyramid scheme, emphasis is put on recruiting new investors. As a reward, scammers promise high interest rates risk-free.
• Everything changes when the victim wants to take out their winnings. Either the contact goes silent, or they ask for additional fees, such as income tax, etc. The scammer may also offer paid legal advice to get back the lost money, and if the victim agrees, another scam cycle begins.

How to prevent investment scams?

• Do some research: Google the company and people (search their photo on google.com) that are offering the investment opportunity. Be vigilant because the scammers may be using detailed false identity. Read more about cryptocurrency schemes on www.chainabuse.com. Google pyramid schemes to get information from financial regulators.
• Discuss it with someone you trust. The scammer may ask you to keep the “opportunity” a secret or instruct you to give false information when responding to the bank’s inquiries, creating a clever illusion of an inner circle. Before making any decisions, ask a friend to take a look at it as a bystander.
• Be very suspicious of offers that seem too good to be true. Think before you act and disclose your information. Would you really do so in a normal situation?
• Do not allow a scammer install remote control software on your computer.

3. Phone scams

Someone calls you from an unknown number or Swedbank’s number, and the caller introduces themselves as a bank employee, public servant, etc. and asks you to take action to prevent damages.

On top of classical phone scams, modern scammers use AI or deepfake calls that are almost inseparable from human voice. When you get a call from an unknown number, it’s relatively easy to suspect fraud, but with deepfake, scammers fake to be your own contacts, such as a friend or child, asking for a quick money transfer. It’s nearly impossible to detect whether the voice belongs to a real person or if it’s created by AI. A good trick is to agree on a secret word beforehand. There are few known cases of deepfake fraud in Estonia, but it’s already spreading across the world.

• Scammers stress on urgency – you need to act fast, or you’ll lose money.
• They urge you to disclose personal details or allow the caller to install software on your device.
• This way, scammers get access to the victim’s account and money, and are free to steal money from the account, take payday loans in the victim’s name, or get the victim to hand over cash (for example, as part of a fake police operation).

How to prevent phone scams?

• The bank or the police never ask you to withdraw money from your account to identify someone’s illegal activity. If someone calls you about a “police operation”, end the call and contact real police.
• Banks and state institutions never ask clients to enter personal passwords or PINs by phone.
• Cut off the call immediately, don’t continue chatting with the scammer. Don’t answer questions because the speech synthesiser learns from every word you say and every piece of information you reveal about yourself.
• Don’t share your bank details, such as username, card details, or PINs with anyone. Real banks never ask for your personal information!
• Do not allow callers install remote control software, such as AnyDesk or TeamViewer on your computer.
• Agree a password with your friends and family for personal conversations to confirm that they are really the person they claim to be.

4. Payment scams

• Advance payments for goods. Often, advance payment is asked by online sellers of foreign vehicles, electronics, or communication devices.
• Post office and courier scam. Targets of these scams are mostly people that order or sell goods to private persons online. The victim gets a text message that they have a parcel waiting but to receive it, they need to click on the link and pay customs tax. Or they contact a victim via Facebook Marketplace, for example, and give a link, asking them to enter their details for delivery by courier. Through the link, they collect data to empty out the victim’s account.
• A favourable loan offer online. Targets are usually people who do not qualify for loans from credit institutions. They need a loan to break out from the payday loan cycle or improve their living standard. To get a loan, they are told to pay transaction fees.
• Inheritance fraud. A victim is told that someone they have never been in contact before has left them a large sum in their will. To receive the inheritance, they are told to pay transaction fees. Lottery and donation scams are similar. The victim is contacted about an alleged lottery win or donation from a charitable organisation.
• “State institution” payment scam. Some of the most common schemes is creating fear of potential issues with government institutions. To avoid problems, the victim is ready to make payments to close an account or cover fines. Examples include a cryptocurrency account opened in the victim’s name without their knowledge to make illegal transactions, watching child porn, etc.

Please note! At first glance, you are contacted by a company, but they ask you to make payments to a private account. Scammers tell you to pay fees, for example for the notary, opening a foreign account, a bank card, delivery of a bank card, certifying documents, etc. Usually, the payments are less than €1,000 but there is more than one payment.

How to prevent a payment scam?

• Think carefully if it’s an actual payment request. Have you played the lottery? Is it realistic that a stranger left you an inheritance?
• Be especially vigilant about offers that require you to make advance payments.
• Make sure that you are really in contact with the service provider they present themselves to be.
• In case of an unknown merchant that urges you to pay, and the offer seems to be too good to be true, it’s most probably a fraud.
• Real state institutions never ask you to make payments in a private account.

5. Love scams

Are you looking for a date or life partner? A love or date scam is made extra complicated by the double suffering of the victim. First, the scammer steals their money, but also violates their trust by creating false feelings.

• Often, lonely people are more susceptible to these scams. They may meet someone on social media or a dating app and feel an immediate connection.
• Fraudsters rely on similar back stories, such as a US soldier ending their career, an actor, another celebrity, a single but successful gentleman, a sailor, etc. Or if the victim is abroad, they pretend to be an investor that relocated to Estonia to advance their career on the recommendation of local friends. If necessary, they may give detailed descriptions of local areas and restaurants they visit. A common thread is that the victim cannot meet the new acquaintance. They avoid turning on the camera in video chats, giving bad connection or low lighting as an excuse. Meetings and dates are postponed for various reasons.
• When the scammer has won the victim’s trust, they ask for money to cover family emergencies (usually, someone from their family needs help with medical costs), buy tickets to finally travel to the victim’s location, pay for package delivery fees, or participate in an investment venture. These scammers are usually not pushy but play on the victim’s feelings to make them want to play along.
• As long as the victim pays, the scammer remains friendly. Once they run out of money, the attitude changes. When the victim finally realises that they have been deceived, they suffer an emotional setback – the whole world seems to collapse.
• A love scam is tricky because the victim has a hard time accepting bystanders’ opinion. They disclose the relationship from friends and family, give deceptive information to bank employees, etc.

How to prevent love scams?

• Acknowledge if you are susceptible to love scams, especially if you are single.
• If a new relationship seems too good to be true, then discuss it with someone you trust. In most cases, your gut feeling is correct.
• Do some research in social media and online. For example, google the person’s profile picture (on google.com). The same names, photos, and schemes have been used for years, and a lot of material is available about them online.
• When an internet acquaintance asks for money, say that you need time to think about it and discuss it someone you trust. Never transfer money to them, whatever the reason may be. Never take a loan to transfer it to your internet acquaintance. If they do not take no for an answer and becomes irritated, it’s most likely a fraud.

6. Work-related scams

Against an employee

The aim is to get employees reveal their passwords and authentication methods to access the employer’s system and business communication through an employee’s computer or monitor mail exchange to find the right moment to request payment to scammers’ account.

• Scammers invade the company’s or their cooperation partner’s email account to get access to their contacts and email contents. This gives a scammer many options to commit fraud. For example, they could use the inbox information to send business partners an email with falsified payment details.
• The email may contain new account numbers to use for future payments, whereas the invoice looks authentic.
• Another option is to send an email from the manager’s account, asking to make a quick transfer.

How to prevent work-related scams?

• Check every request from business partners, especially if they ask you to change the account number for future payments. Use a different communication channel to check the validity of the transaction.
• Assign a single main contact person to communicate with companies whom you make regular payments.
• Set a rule for payments exceeding a limit that you make extra checks of bank account and sender (for example, by making an extra check by phone).
• When you receive a message that a business partner wishes to change their details, send an information inquiry on their previous regular contact address. Do not use contact details used in the most recent letter or email.
• After paying an invoice, send the recipient a confirmation letter. To ensure safety, mention the bank name and last four numbers of the account used to make the payment.
• Ask your employer or colleague by phone or in person if they really asked you to make the payment.
• Be vigilant about the information you share about your employer in social media.

Against a job candidate

• There’s a job ad in social media, offering an opportunity to earn money from finance intermediation, etc. As a next step, the victim needs to confirm their identity by disclosing their username and confirm transactions with their PIN.
• Scammers use the false website to collect data and get the candidate to confirm transactions with their PINs, thinking it’s a part of recruitment process.

How to prevent work-related scams?

• Do some research on the recruiter.
• Think before you act and disclose your personal details.
• Never share your bank details, such as username, card details, or PINs with anyone.
• When entering your PIN, make sure that you initiated the payment and that the details are correct (compare the control codes). Keep in mind that PIN1 represents you and PIN2 is your signature.