Skip to content
Cyberschutz.io

Spotting phishing in emails, texts and QR codes

How to recognise fake messages and verify suspicious requests safely.

Checked on · Cyberschutz.io editorial team

Contents

Short answer

Phishing messages try to rush you into clicking, entering details or making a payment. The most reliable defence: never follow the link or QR code in the message. Check the request yourself – in the known app or by typing the address you know.

Step by step

  1. 01

    Recognise pressure and urgency

    Threatened account blocks, supposed refunds or “security updates” with short deadlines are typical bait. The more urgent a message sounds, the more closely you should look.

  2. 02

    Check sender and destination

    Display names are easy to fake. Check the actual sender address and – without clicking – where the link leads. With texts and messenger apps, this is often not reliably possible.

  3. 03

    Verify independently

    Open your bank's or the service's app directly, or type the known address yourself. If there is no message there, the email or text is very likely fake.

  4. 04

    Treat QR codes like links

    A QR code is just a hidden link. Printed codes on letters, parking meters or posters may have been covered with a fake one. Check the displayed address before opening it.

  5. 05

    Report and delete

    Forward phishing to the affected provider's abuse address, if it lists one, and then delete the message.

Checklist

  • I don't click links in unexpected messages about accounts, parcels or payments.
  • I check requests in the known app or via an address I type myself.
  • I never share one-time codes, TANs or passwords on request.
  • Important accounts are protected with MFA or a passkey.
  • I know how to reach my bank in an emergency.

Common mistakes

  • Trusting a correct logo or a personal greeting – both are easy to copy.
  • Taking “just a quick look” at the link and entering credentials along the way.
  • Reading out a confirmation code received by text over the phone.
  • Waiting out of embarrassment after a mistake instead of contacting the bank straight away.

Frequently asked questions

Is a message with my real name automatically genuine?

No. Names and sometimes other details often come from earlier data leaks. What matters is whether the request can be confirmed through an independent channel.

What should I do if I've already clicked the link?

A click alone often causes no damage yet. If you entered details, change the password from a trusted device, end unknown sessions and, for bank or payment details, contact your bank immediately via the known phone number.

Does my spam filter reliably catch phishing?

Filters catch a lot, but not everything. Targeted or new campaigns regularly get through – which is why your own check remains important.

Where can I see current phishing waves?

The Phishing Radar of the German consumer advice centre (Verbraucherzentrale) documents current fake messages, for example in the name of banks and payment services.

Sources

Checked on 6 Oct 2026.

Read next