Payment and identity scams (Phishing, Fake-Inkasso)

Level 1 · Basics⚖ Judgment

German termPhishing / Fake-Inkasso

Payment and identity scams manipulate the authorization process rather than offering an investment. Attackers impersonate banks, authorities, relatives, shops, or debt collectors; steal credentials; or persuade victims to approve a transfer themselves. The durable defense is channel separation: stop, independently locate the real institution, and verify before sharing data or moving money.

The stop–separate–verify procedure

German police guidance explains that stolen identity data can come from phishing messages, fake banking sites, shops, or data leaks [1].

Worked scenario

A caller displays the bank’s name and says a “security transfer” must be approved within five minutes. The caller knows the customer’s address and recent transaction amount.

Caller ID and personal details are not independent proof; both can be spoofed or stolen. The request fails channel separation. Ending the call and contacting the bank through the app tests the claim without using the attacker’s route.

Check yourself

A caller claiming to be the bank demands a security transfer. What is the next step?

End the call and contact the bank through its official app or known numberApprove a small transfer

Credentials may have been disclosed. Which containment steps apply? Select all that apply.

Contact the bank through an official channel immediatelySecure affected accounts and credentialsPreserve messages and transaction evidenceDelete everything before reporting

The caller ID shows the bank's name and the caller knows the customer's address. Is that independent verification?

YesNo

Which action preserves channel separation?

Reply to the message asking whether it is genuineOpen the institution's official app independently

The stop–separate–verify procedure​

Worked scenario​

Check yourself​

Sources​

The stop–separate–verify procedure

Worked scenario

Check yourself

Sources