Phishing: What it is and how to protect yourself

The Internet makes our lives easier in many ways. Online shopping, communication and surfing are part of everyday life for many people.But the Internet also offers new opportunities for fraudsters. Criminal organizations often use global networks to reach their victims digitally. These criminals are becoming increasingly professional, are constantly developing new methods, and go to great lengths to deceive people – including via phishing.

Phishing is the attempt to steal personal data such as passwords, credit card details or access codes via fake websites, emails or text messages – the objective being to raid your account or harm you in some other way.

Vishing (voice phishing) is a variant of phishing that is carried out by telephone. Here too, fraudsters try to obtain personal data unlawfully. This method is particularly effective and therefore popular with criminals. Vishing attacks are often difficult to detect, as callers can manipulate the telephone number that is displayed (“spoofing”). This makes it hard to verify the identity of the caller, especially if a familiar or trusted number is shown.

Phishing and vishing are forms of what is known as social engineering. They are targeted attacks that aim to trick victims into disclosing personal data. The term “phishing” comes from the English word “fishing,” where the “ph” stands for “password harvesting.”

“We regret to inform you that your parcel could not be delivered because the shipping costs have not been paid.” Does this sound familiar? If you regularly surf the Internet, you have probably already received emails or text messages like this, asking you to click on a link.

Fraudsters often pose as trustworthy senders – such as a bank, delivery service (post office or DHL) or streaming service (Netflix or Spotify). It is difficult to completely prevent these phishing messages because email addresses and telephone numbers are passed on or sold both legally and illegally.

On the fake websites, victims are asked to enter sensitive data such as credit card details, SMS codes, Digital Banking contract numbers, access card codes or passwords. Criminals use this information to make credit card payments, for example, or to log into your E-Banking account.

Nevertheless, you are not defenseless against phishing attacks. Despite the different methods used, there are typical features that enable you to recognize phishing:

1. You don’t know the sender, and the email address is different from the company’s official address.
   
2. You are not addressed personally (“Dear customer”).
3. The message asks you to take urgent action (“Log in,” “Confirm ...”) or contains threats (“Otherwise your account will be blocked”).
4. The content is written in poor or incorrect English.
5. In German, the umlauts (ä, ö, ü) are missing or are replaced by ae, oe, ue.
6. You are asked to disclose personal data.
7. The URL contains suspicious characters or additions, such as u-bs.com or ubs-customers.com. Official UBS websites always include “.ubs.com/” in the address line.
   
8. There is no SSL (Secure Sockets Layer) security certificate on the linked website.

A transaction authorized by you can’t be refunded even in the event of fraud. That’s why it’s so important to remain vigilant at all times when surfing the Internet.

As an additional security measure, you can adjust your individual settings, e.g. in UBS Digital Banking, so that you receive push notifications about every transaction. This means you are constantly informed, can react immediately in an emergency and prevent unauthorized transactions.

If you notice any misuse, you should block your credit, prepaid or debit card immediately. If you are unsure whether your card has been misused, you can also temporarily deactivate it to be on the safe side.