Protection & safety · General financial education

Finance phishing

Phishing tries to obtain login data for an account or brokerage via fake emails, SMS or pages that look like a bank.

In more detail

BaFin notes: banks and card issuers do not ask for PIN or TAN by email. Do not open unknown links or attachments. Check via a number or address you already have, not the one in the message.

Background

Related methods: QR codes (quishing), lookalike domains, alleged emails from a supervisor. A second channel (a known app or a known website you type yourself) separates original from copy. Finmon recommends no branded app.

An example

An email „Your transfer needs confirmation“ with a link. The bank you already use has an address or app you know, not the link in the email.

A common misconception

If logo and layout match, the email is from my bank.

Phishing copies the look. Banks do not ask for PIN and TAN by email. Check via a known channel.

Source: BaFin · Datendiebstahl / Phishing. Last reviewed: 2026-11-09. Editorially reviewed on 2026-11-09. Next review 2027-11-09. Version 0.2.0. Finmon explains. It does not advise. Not investment, tax or legal advice.