An email from your bank opens with a warning: criminals are sending fake bank emails. Scroll down and it asks you to click a link. That email is the crime, and Germany’s central bank has spent the last two weeks trying to teach the country to see it.
What is actually going on
On 10 October the Bundesbank and the Federal Ministry of Finance started a campaign called “Machen wir Phishen Impossible!” — roughly, let us make phishing impossible. Phishing means fake messages, calls or websites that copy a company you trust, so that you hand over a password or approve a payment yourself. For about a month, banks, phone companies, retailers and public bodies are pushing the same advice under that name. The campaign’s own summary is three words: pause, think, protect yourself.
The reason is a number. According to the Bundesbank, about 1.8 million fraudulent payment transactions in 2025 caused more than 580 million euros of damage. That is money taken from ordinary accounts, in one year, in a country of 83 million people.
The campaign landed in the middle of a wave. The consumer advice centre for North Rhine-Westphalia publishes the fake emails that readers send in, each with a date. In the past ten days the list carried PayPal on 23 October, easybank on the 22nd, Volksbank on the 21st, Amazon on the 20th, ING on the 19th and comdirect on the 16th. Six names you know, in eight days.
The easybank mail is the one to study. It says a new kind of instant transfer must be switched on, that your account stays blocked until you do it, and that you should not interrupt the process. Then comes the closing line: “EasyBank will never ask you to share confidential data via a link.” Directly above a button that asks you to do exactly that.
Why it matters to you
Each of these mails picks something you really have — a Prime membership, a current account, a savings account — and invents a small administrative problem. A payment that failed. A security update. Details that need confirming. The problem is boring, and that is the point: boring problems get solved quickly, without asking anyone for a second opinion.
What the criminals want is not your password on its own. It is the moment your bank asks you to approve a transfer. Type your login and the code your bank sends into their page, and the transfer is real: your bank sees the right password and the right confirmation. An instant transfer arrives within seconds. Whether the money comes back depends on how fast you call your bank, and it is never guaranteed.
The deadlines are invented, and they are the loudest signal in the whole message. PayPal gave 24 hours. ING gave 48. Two of the mails said the account would be blocked. Real security work at a bank does not run on an email countdown.
What you can actually do
- Never use the link. Open your bank’s app, or type the address you already know into the browser. If the message is genuine, the same warning is waiting there.
- Read a deadline as the alarm. The shorter the countdown and the bigger the threat, the less likely it is that a bank wrote it.
- If someone calls, hang up. Then call the number printed on your card or on your bank statement. A caller who insists you stay on the line is keeping you away from that number.
- Check before you decide. The Phishing-Radar on verbraucherzentrale.nrw lists the fakes of the past days, with screenshots. You can also forward a suspicious mail to the centre’s phishing address.
- If you already typed your details, call your bank now. Ask them to block the card and the account, and report it to the police. Speed decides whether a transfer can still be pulled back.
Common misunderstandings
Myth: a personal greeting means it is real
The Amazon fake from 20 October used the reader’s name. The consumer advice centre lists that as a detail to ignore, not a reason to trust. Names come from old leaks and from what you post publicly.
Myth: my bank would never email me about security
Many do, and that is exactly why the fakes work. The difference is what the mail asks for. A real bank may tell you to check your account. It does not ask you to prove who you are through a page you reached from an email.
Myth: the confirmation code protects me
The code proves to your bank that whoever is typing is you. If you type it into a page the criminals control, it proves you to them, and they pass it on in the same second.
What to watch for next
The campaign runs until roughly 10 November, and its advice is now public material. Expect mails that quote it back at you: a “security check”, a leaflet as a PDF attachment, or an official-looking warning about phishing that ends with a link.
Then comes the Christmas season. Parcel notices, customs fees and failed payments multiply in November and December, because that is when many people are waiting for something and paying for it.
The one thing to remember
The link is the crime; the story around it is only the packaging. Your bank already knows who you are, because you log in to it. So close the mail, open the app, and let the real message, if there is one, find you there.
Image credits: the photo of the Bundesbank tower in Frankfurt is by Boubloub, via Wikimedia Commons, released under CC0 (public domain dedication).