Does the message correspond to a real process?
First check whether you yourself triggered a relevant action on suchen.expert immediately beforehand. This may include registering, activating an account or resetting a password. In such cases, an expected email may contain an activation or reset link.
Compare the reason, time and account mentioned with your own activity. An unexpected reset message does not automatically mean that someone has access to your account. Your address may have been entered in a form accidentally or deliberately. Even so, do not open the link in the message if you did not initiate the process yourself.
Remain alert even when a message is expected. Attackers may take advantage of the timing of a genuine process or send a similar-looking message. The timing alone therefore does not prove authenticity.
Check the full sender address and reply-to address
A visible sender name such as suchen.expert can be freely chosen or forged. You should therefore display the full email address.
Look out for:
- transposed or similar-looking letters,
- additional words,
- unusual characters,
- spelling mistakes,
- an unsuitable domain after the @ sign.
If your email program displays this information, also check the reply-to address or Reply-To field. A different reply-to address may have a technical explanation, but should raise suspicion if it uses an unfamiliar domain or one that you cannot account for.
Do not rely solely on a sender address that appears plausible. Sender details can be manipulated, and a genuine email account may also have been misused. Take warnings from your email provider about a failed sender check seriously.
With SMS messages, both a telephone number and a displayed sender name can be manipulated. Depending on the device and messaging service, a fake message may even appear in an existing message thread. A familiar sender name or the same SMS thread is therefore not reliable proof of authenticity.
Check the link destination and domain
Check the actual destination of a link without opening it. On a computer, it is often displayed when you hover the mouse pointer over the link. A link preview may be available on mobile devices.
If the destination cannot be identified safely, do not use the link.
Pay attention to the domain that is actually registered. An address such as suchen.expert.beispiel.de belongs to beispiel.de, not to suchen.expert.
Additional words, transposed characters, similar-looking letters or unusual domain endings may be used to deceive you. Shortened links conceal the destination and should not be used without checking them for security-related processes.
The padlock symbol and https merely confirm that the connection to the website you opened is encrypted. A fake website can also use HTTPS. Encryption proves neither that the page comes from suchen.expert nor that its content is trustworthy.
Do not ignore browser warnings about certificates or insecure connections. Do not enter sign-in details on such a page, and do not install any allegedly required certificates, programs or extensions.
Handle activation and reset links correctly
An activation or password-reset link is not suspicious merely because it enables a security-related action.
If you initiated the registration or reset yourself through the suchen.expert website that you opened manually, such a message may be expected.
Nevertheless, treat the complete link as confidential security information:
- Use it only for the process that you initiated yourself.
- Do not forward it.
- Do not publish a complete screenshot of it.
- Do not copy it into chats, forms or support requests.
- If you receive several messages, always use the latest link, because a new process may supersede an older link.
- Do not open it if the reason, time or destination address is unclear.
Depending on the process, links may be usable only once, time-limited or no longer valid after a more recent request.
If you are in doubt, open suchen.expert manually and restart the process that you want there, if the relevant function is provided.
Further information about the difference between sign-in, security checks and authorisation can be found in How does suchen.expert protect my account during login and authorisation?
Content and tone are not proof of authenticity
A genuine message may be brief or automatically generated. Conversely, a fake message may be written without errors, use genuine logos and contain personal details.
Do not assess a message solely by its design, spelling or form of address.
Warning signs include:
- unexpected time pressure or threats involving account suspension, charges or legal consequences,
- requests to disclose a password, one-time code, PIN, TAN or payment details,
- a request to process a payment, refund or account check through a third-party link,
- a demand to install an app, browser extension or remote-access software,
- a request to disable security features,
- a request to approve a sign-in that you did not initiate yourself,
- unusual payment methods,
- an unexpected switch to an external communication channel.
Passwords, one-time codes, complete security links, PINs and TANs are not required for a normal support check and must not be disclosed.
Handle attachments and QR codes with care
Do not open unexpected attachments, even if the file name, logo or sender appears plausible.
Do not enable macros, editing features or embedded content, and do not install software offered in a message.
A QR code is a link that cannot be read directly. After scanning it, first check the displayed destination address and open it only if the reason and domain can be clearly verified.
A professionally designed message or a QR code on an apparently official document does not confirm its origin.
Open suchen.expert independently of the message
Open suchen.expert using an address that you entered yourself or your own saved bookmark. Sign in there and check whether the claimed process matches your account, an actual message or a process that you initiated.
Not every email also has to appear as a notification in the account. The absence of a corresponding platform message therefore does not by itself prove that the email is fake. What matters is whether you can verify the process independently of the message that you received.
If in doubt, do not reply to the suspicious email or SMS and do not use a telephone number provided in it.
Instead, contact support through the official suchen.expert contact form.
General identifying features can also be found in How do I recognise phishing attempts and fake messages?
Information that helps support
The following details may be useful for a review:
- the date and time of the message, including the time zone,
- the channel used, such as email or SMS,
- the subject and exact wording of the suspicious message,
- the visible sender name and the full displayed sender address,
- any different reply-to address,
- for an SMS, the displayed telephone number or sender name,
- the domain of the link destination or an abbreviated form of the URL without personal parameters and security tokens,
- a brief description of whether you had previously initiated a registration, activation or password reset yourself,
- a screenshot in which confidential and unnecessary personal data has been obscured.
Never send your password, a one-time code, the complete activation or reset link, cookies, session identifiers, payment details or unsolicited identity documents.
Complete email headers may also contain personal and technical data. Send them only in response to a specific request and through an official channel.
Information about the handling of personal data can be found in the Privacy Policy.
Preserve suspicious messages as evidence
If you want to report the message or damage has already occurred, preserve it before deleting it.
Where possible, retain:
- the original message,
- sender details,
- the date and time,
- screenshots,
- the displayed link destination,
- information about the affected account or process.
Do not reopen suspicious links or attachments for this purpose.
Do not forward complete security links or potentially harmful attachments unless specifically asked to do so. Also use your email or mobile network provider's reporting function, if one is available.
If you have already interacted with the message
If you only opened a link but did not enter any data, run a file or grant permission, close the page.
Check whether a file was downloaded, and do not open it. A click alone does not prove that a compromise has occurred. Nevertheless, watch for unusual account activity and security messages.
If you entered or disclosed a password, a one-time code or a complete security link, open the affected service on another trusted device using the address that you entered yourself.
Change the affected password and change it for every other account where the same password was used. In particular, secure the associated email account and end unknown sessions if the relevant service provides this function.
If you ran an attachment, enabled macros, installed software or allowed remote access, do not use the affected device for sign-ins or payments for the time being.
Disconnect it from the network if it is safe to do so, have it checked with up-to-date security software and seek expert help if necessary. Change sign-in details from another trusted device.
If you disclosed payment details or already initiated a payment, contact the bank, card issuer or payment service provider immediately through its official contact channel. Recovery of the payment cannot be guaranteed.
If there are signs that an account has been accessed, follow the steps in What should I do if I suspect unauthorised access to my account? and inform suchen.expert through the official contact form.
