How to spot phishing: 8 signs of a fraudulent message

A phishing message may look like an email from a bank, a notification from a government agency, a message from a delivery service, technical support or even someone you know. Fraudsters usually have one aim: to trick someone into clicking a link, revealing a password or bank details, installing malicious software, or transferring money themselves.

SocPortal has compiled a checklist based on the latest recommendations from the National Bank of Ukraine, the Cyber Police and the State Special Communications Service. It was verified on 13 September 2026. The points are not ranked: even a single one of them is reason enough to pause and double-check the message via an official channel.

Details

How the checklist was compiled. We have included only the warning signs that a person can check before entering data, making a payment or installing a file. The checklist is based on recurring recommendations from official Ukrainian bodies regarding payment and cybersecurity. The main principle: do not trust the appearance of a message and verify the request via the organisation’s official website, app or telephone number.

Short answer: do not click on a link in an unexpected message if you are being rushed, asked for confidential details, offered a payment via a third-party website, sent a file to ‘verify’ something, or directed to an unofficial bot. Open the relevant service yourself and check the information there.

1. You’re being rushed and threatened with consequences

Phrases such as ‘your account will be blocked’, ‘your account will be deleted today’, ‘you have 10 minutes left’, or ‘you must confirm your details immediately’ are typical social engineering tactics. The sense of urgency is designed to make you act on autopilot without having time to verify the sender.

What to check: does the message contain pressure, a threat of suspension or a demand to take action right now? If so, do not use the link in the message. Go to the app or the organisation’s official website manually.

2. You are asked for your password, PIN, CVV/CVC or one-off verification code

The NBU advises keeping the three-digit code on the back of your card, your PIN, online banking passwords and one-off verification codes confidential. If you are asked for this information in an email, via a messaging app, in a chat or via a link, the message should be treated as suspicious.

What to check: whether you are required to provide details that can be used to log in to your account or confirm a transaction. You do not need your CVV/CVC, PIN or bank password to receive a standard transfer to your card.

3. The link’s address differs from the official one by at least one detail

Phishing websites often copy the design of the genuine service but use a similar domain: an extra letter, a hyphen, a different top-level domain or a long combination of words. The cyber police specifically warn that even a convincing design does not confirm the authenticity of a website.

What to check: the full web address before entering any details. The presence of ‘https’ alone does not mean the website is genuine: the NBU advises that, after checking the protocol, you should continue to verify the domain.

4. You are directed to an ‘official’ bot or a login page directly from a message

Fraudsters create bots and pages that mimic banks, government services and support services. The name, logo and even the appearance of the interface can be copied.

What to check: did you find this bot or page via the organisation’s official website or app? If the link arrived in a newsletter or from an unknown account, it is safer to open the official site yourself and navigate to the required service from there.

5. You are promised a payment, compensation or bonus and are immediately asked for your bank details

One common scam involves messages about social security payments, assistance from the government or international organisations, refunds, bonuses and prizes. Users are directed to a fake page where they are asked to enter their card or online banking details.

What to check: see if there is any information about such a scheme on the organisation’s official website, in the bank’s app or on Diia. If you only know about the ‘payment’ from a message containing a link, do not enter your details.

6. A file is attached to the message or you are asked to install a programme

Phishing doesn’t always end with a password form. In May 2026, the State Special Communications Service warned about emails posing as messages from CERT-UA and demanding that recipients urgently open attachments or follow instructions to supposedly scan their computers. Such files may contain malware.

What to check: were you expecting this file, and can you verify its origin via another channel? Do not run any programmes or install remote access tools following instructions from an unexpected email or chat message.

7. The sender appears official, but the communication channel does not match the official one

A logo, photo, employee name and corporate colours are not proof of authenticity. The cyber police have recorded scams in which fraudsters use genuine images and branding from government agencies, banks and social media platforms.

What to check: whether the email address, telephone number, account or bot matches the contact details on the organisation’s official website. If in doubt, end the conversation and ring the number listed on the official website yourself.

8. An unexpected link or request for money arrives from someone you know

A message from a friend isn’t always safe: their account may have been hacked. The NBU advises against rushing to click on an unexpected link, even if it comes from someone you know, and to contact the person via another channel first.

What to check: whether such a request is typical of the person and whether they confirm it by telephone or via another channel. Be particularly wary if an acquaintance suddenly asks you to vote via a link, borrow money or ‘help urgently’.

If you have already clicked on the link: if you haven’t entered any details, close the page and do not download anything. If you have disclosed your password, change it on the official website and log out of any unfamiliar active sessions. If you have disclosed your card details or online banking details, contact your bank immediately using the official number and block your card or access to your accounts. You can report the fraud to the Cyber Police.

Why this is important

Modern phishing attempts are increasingly unlikely to look like obviously poorly written emails. Fraudsters copy genuine websites, use familiar logos, and capitalise on plausible themes and current events. Therefore, simply checking spelling or the appearance of an email no longer provides reliable protection.

This checklist does not allow you to prove that a message is fraudulent based on a single indicator. Its purpose is to stop a dangerous action before you hand over your details or money. The most reliable habit is to separate the message from the action: do not log in to your account or make a payment via a link sent to you, but instead open the official website or app yourself.

If a critical check is not passed – for example, the domain is different, confidential banking details are being requested, or you are asked to install an unknown file – it is best not to proceed until you have carried out an independent check.

Source

• National Bank of Ukraine, #ShakhrayGoodbye project : payment security and common fraud schemes. Verified on 13 September 2026.
• Cyberpolice of Ukraine, ‘How to recognise fraudulent messages disguised as spam and promotional offers’, 15 April 2026.
• Cyber Police of Ukraine, ‘How to recognise phishing emails from social media “support services”’, 24 October 2025.
• State Special Communications Service/CERT-UA, warning about phishing emails sent in the name of CERT-UA and the State Special Communications Service, 26 May 2026.