What phishing means
In phishing, criminals attempt to trick you into disclosing confidential data, opening malicious content or making a payment. To do this, they may imitate the appearance of suchen.expert, a payment service provider, a bank, a delivery company or a well-known user.
Such attempts do not occur only by email. They may also reach you by SMS, messenger, social network, telephone, QR code or through a messaging feature. Even a message within a platform is not automatically trustworthy, because another user’s account may have been misused.
Fake login, activation and payment pages can look very similar to the originals. Therefore, familiar logos, colours and personal details in a message do not prove that it is genuine.
Typical warning signs
A single sign does not in itself prove fraud. If several of the following points apply, you should be particularly cautious:
- The message arrives unexpectedly or does not correspond to an actual activity in your account.
- You are allegedly required to act immediately, otherwise your account will be blocked, a listing deleted, a payment cancelled or some other adverse consequence will occur.
- Fear, curiosity, sympathy, an unusually large prize or an especially attractive offer is used to create a sense of urgency.
- You are asked to disclose your password, a one-time code, a PIN, a TAN, a card verification number, a full activation or reset link, or other security details.
- The communication or payment is suddenly supposed to take place outside of suchen.expert.
- Unusual payment methods or ones that make it difficult to recover the money are requested, such as voucher codes, cryptocurrencies or a bank transfer to an untraceable third party.
- A supposed support representative wants remote access to your device, demands that you install an app or asks you to disable security settings.
- The sender’s name seems familiar, but the actual email address, phone number or social media account does not match.
- A link, QR code or attachment is not required for the stated purpose or was not expected.
- The form of address, language or behaviour differs noticeably from previous communication.
- A payment is suddenly to be made to a different recipient or to a new account.
Flawless language is no guarantee of authenticity. Criminals can use professionally written messages, personal details, familiar profile pictures, publicly available information, content from data breaches or compromised accounts.
Check the sender and actual address
With emails, the visible display name can be freely chosen or spoofed. You should therefore view the sender’s full address and check, in particular, the part after the ‘@’ symbol.
Look out for:
- transposed or missing letters,
- characters that look similar,
- extra words or hyphens,
- unusual domain extensions,
- a reply-to address that differs from the visible sender’s address.
The displayed phone number for a call or SMS can also be spoofed. A familiar name or number on the display is therefore not reliable proof of who is actually contacting you.
Even a message in an existing conversation thread can be fake if the other person’s account has been taken over. You should therefore verify unusual requests through a second, already known contact channel.
Check the domain and link destination
Check the actual link destination without opening the link. Many email programmes display it when you hover your mouse pointer over the link or use a preview function.
On smartphones, with shortened links or behind buttons, the destination may be harder to identify. If the full address is not clearly visible, do not open the link.
In the case of a web address, the actual domain is crucial. An address such as ‘suchen.expert.beispiel.de’, for example, belongs to ‘beispiel.de’ and not to suchen.expert. Additional words before or after the expected name can be misleading.
The padlock icon and ‘https’ merely indicate that the connection to the website being accessed is encrypted. Even a fraudulent website can have a valid HTTPS certificate. HTTPS alone does not confirm either the operator or the authenticity of a page.
Check QR codes just as carefully
A QR code is also a link whose destination is not initially visible. Scan it only if you can verify its source and purpose.
Check the displayed destination address before opening it. After scanning, do not enter any sign-in details or payment information if the domain does not clearly belong to the expected provider.
Further guidance can be found in How can I check whether an email or SMS really comes from suchen.expert and is not a phishing attempt?
Be cautious with attachments and downloads
Do not open any unexpected attachments. Particular caution is advised if a message asks you to:
- run an executable file,
- enable macros or additional content,
- install an app or browser extension,
- open a password-protected archive,
- install a certificate or security profile,
- bypass a browser or security warning.
PDF, Office and image files should also be opened only if you can verify the sender, reason and file.
A supposed support representative does not need remote access to your device to investigate a routine enquiry.
Do not disclose confidential data
Never disclose passwords, one-time codes, PINs, TANs, full activation or password-reset links, session cookies or other security details to other people.
Do not approve a sign-in or payment that you did not initiate yourself. Do not share card, bank or identity-document details merely because of an unexpected message.
Do not allow anyone to instruct you over the phone to install software, share your screen, disable security features or transfer money to a supposedly ‘secure’ account.
suchen.expert support also does not need a password or one-time confirmation code to process an enquiry.
Check the situation without clicking
Open suchen.expert yourself by entering the known address directly in your browser’s address bar. Sign in there and check whether the claimed activity, listing or message actually exists.
Do not use any link or QR code from the suspicious message to do so.
If a person you know, a company, a bank or a payment service provider claims that you need to act urgently, check with them through a separate contact channel that you already know. Do not use any telephone number, email address or contact option from the suspicious message.
If you have any doubts about a purported message from suchen.expert, you can use the official contact form. Do not disclose any passwords, codes or full security links when doing so.
Preserve suspicious messages and evidence
Do not delete a potentially fraudulent message prematurely if harm has already occurred or you want to report the incident.
First preserve the following, where it is safe to do so:
- the original message, including the date and time,
- the sender’s full address or telephone number,
- the user or social media profile used,
- the message history,
- the name or ID of the affected listing,
- the visible link text and the actual destination address,
- any QR code or attachment received, without opening it again,
- screenshots of the message or fake page,
- payment receipts, recipient details and transaction numbers.
Where possible, do not alter the original files. Do not forward suspicious attachments to other people unless specifically requested.
Use the reporting channels provided by the relevant email, messenger or social media service. If there is a connection to suchen.expert, also report the incident using the official contact form.
If you have already clicked on a link
A click alone does not automatically mean that your account or device has been compromised. Close the page, do not enter anything there and do not confirm any downloads or browser prompts.
Make a note of or save the destination address and check whether a file has been downloaded. Do not delete a downloaded file immediately, as it may still be required for a technical investigation or as evidence. Under no circumstances should you open it again.
Update your browser, operating system and security software. Even if you have not entered any data, opened any files or granted any permissions, you should still monitor your accounts for any unexpected activity.
If you notice unusual sign-ins, messages or changes, follow the steps in the article What should I do if I suspect unauthorised access to my account?
If you have entered sign-in details or a code
On a trusted device, open the affected service by entering its official address yourself and change the password.
Use a new, long and unique password. Guidance can be found in How do I create a secure password for my suchen.expert account?
If the same password was used for other services, change it there as well. Secure the associated email account first, because it can often be used to reset access to other accounts.
Check any available account information and end any unknown sessions, if the service in question offers this option.
If you entered your Google sign-in details on a third-party website, secure the Google account through the official Google page, opened manually.
If you have disclosed a one-time code or security link, take immediate action. Such information can be used to gain access within a short period. Also inform the affected provider through its official contact channel.
If you have opened an attachment or a piece of software
Simply viewing a familiar document format does not necessarily lead to an infection. However, you should exercise particular caution if you have:
- launched an executable file,
- enabled macros or additional content,
- installed an app or browser extension,
- granted remote access,
- confirmed a security warning.
Close any suspicious programmes and do not use the device for logins or payments for the time being. Disconnect it from the network, where it is safe to do so, and run a full scan using up-to-date security software.
Change any important login details from another trusted device. If the device is a company-owned or managed device, inform the relevant IT department immediately.
If the findings are unclear or unusual activity persists, specialist technical assistance may be required.
If you have already made a payment or submitted payment details
Contact your bank, card issuer or the payment service provider you used immediately via their official website, app or a known telephone number.
Ask them to check whether access to an account or a payment instrument can be blocked and whether a transaction can still be stopped or disputed. It is not always possible to recover the money.
Check for any further transactions and keep a record of payment confirmations, recipient details and the message history.
Further steps can be found in What should I do about suspicious PayPal or payment transactions?
If personal data is affected
If identity-document images, address details, account details or other personal information have been shared, document exactly which data is affected.
In the case of payment or identity documents, inform the issuing bank or authority via their official contact channels where necessary. You should then be particularly vigilant for any further attempts to contact you, account openings, orders or payment demands made in your name.
The article What should I do if my personal data has been misused? explains further possible steps.
Beware of a second wave of fraud
Following a known case of fraud, other individuals may contact you and claim they can recover lost money, unblock your account or delete your personal data.
Such supposed helpers may already be aware of details of the initial incident. Do not pay any processing, release or recovery fees, and do not disclose any further details.
Verify any offer of help independently via the official contact channels of the organisation in question.
How to reduce the risk in the long term
Use a separate, long password for each important account. Take particular care to protect your email account, as this can be used to regain access to other accounts.
Enable multi-factor authentication or a passkey for your email, Google, banking and payment service accounts, if this is offered.
Keep your browser, operating system, apps and security software up to date. Use the spam and phishing reporting features provided by your email or messaging service.
Bookmark frequently used official websites or type in their known addresses manually. Always check unexpected account, payment and security notifications directly within the relevant service.
Guidance on protecting the associated email account can be found in How can I make sure my email address is protected?
Further independent information is available from the Federal Office for Information Security (BSI) and the Consumer Advice Centre.
