Got a strange SMS or e-mail? How to spot a scam and what to do

Q: How can I tell that a message is a scam?

Look for a combination of signs: time pressure (“within 24 hours”), a link that looks almost right but whose domain doesn't match, a request for your password, PIN or SMS code and a greeting without your name . The more of them a message has, the more certain it's a scam. If you're not sure, don't click anything and check it another way.

Security

12. 9. 2026

Have you received a strange SMS or e-mail – saying you need to pay extra for a parcel, verify your account or that “we will block” something of yours? You're not alone, and it's not your fault. Scam messages are common today and can look convincing. The good news is that they can almost always be recognised by a few recurring signs. In this article, we'll show them on specific examples – and, above all, we'll go through exactly what to do if you've already clicked.

In short: any message is suspicious if it puts you under time pressure, contains a link whose domain doesn't exactly match, or asks for a password, PIN or a code from an SMS. If something like that arrives: don't click, don't enter anything, and check it via the official website or app.

How to spot a scam

Scam messages differ in topic, but the tactics are usually the same. Once you know these signs, you'll recognise even a message you've never seen before.

Scam messages give themselves away by recurring signs – the more of them fit, the more careful you should be.

1. It rushes you and tries to scare you

“Your account will be blocked”, “your parcel will be returned”, “final notice”. The aim is to make you act before you have time to think. A reputable company, on the other hand, gives you time and leaves the decision to you.

Artificial time pressure is the most common lever scammers pull. A reputable company won't rush you.

2. A link that looks almost right

The most common trap. The address starts in a way you trust, but the real domain – the part just before the first slash – belongs to someone else. The difference is often one extra word or a swapped letter.

An address may start in a way you trust, but the real domain comes only at the end, before the first slash.

3. It asks for details the company doesn't need

Neither your bank nor an online shop will ever ask you for your password, PIN or the code from a verification SMS – these are only for logging in and making payments, and the company doesn't need them to do its job. As soon as someone asks you for them in a message, it's a clear sign.

A reputable company will never ask you for your password, PIN or SMS code in a message.

4. A greeting without your name

“Dear customer”, “Hello, user”. Mass scam messages usually don't know your name. A missing name doesn't prove a scam on its own, but together with other signs it's one more warning.

What scam messages most often pretend to be

The topic changes, the tactics stay the same. If you know which disguises scams most often come in, you'll find them easier to spot:

Parcel delivery – “pay the customs duty / delivery fee”, often with a link to a payment.
Bank or payment – “verify your account”, “suspicious transaction”, “restore your access”.
Prize or gift – “you've won”, “collect your reward”; supposedly all you need to do is enter your details.
Unpaid invoice – an attachment or a link designed to cause panic and a quick click.
Request from “IT support” – someone pretends to be a technician and wants access or your password.

Whichever of these arrives, the same rule applies: don't deal with it via the link in the message, but via the official website or app of the service in question.

How to check a link before you click it

Before you click on anything, you can check it calmly.

Before you click a link: check the domain – and better still, find the website yourself.

Golden rule: if you're not sure, don't click the link and find the website yourself – type in the address by hand or use your app. That way you get around any fake link.

What we will never ask you for in our name. So that you can easily recognise a fake message sent in ÚVT's name: we never ask you by e-mail or SMS for your password, PIN, the code from a verification SMS or your full payment card number. If anyone asks you for this “on our behalf”, it's a scam.

What to do if you have already clicked or entered your details

It happens even to careful people – there's nothing to be ashamed of; what matters is to act. Go step by step:

1Change your password for the affected service. And wherever you used the same password, change it there too – attackers try it elsewhere as well.

2Turn on two-factor authentication if you don't have it yet. It stops anyone logging in, even if they know your password.

3Were payment details involved? Contact your bank through its official channel – via its app or on the number on the back of your card. Never via a contact given in the message.

4Scan your device with antivirus software, especially if you downloaded or installed anything. There's a guide in our article how to protect yourself from malware.

5Keep an eye on your account and statements for the next few days and watch out for unknown payments or logins.

The best safeguard for the future: two-factor authentication

If you take away just one thing from this whole article, make it this one. Two-factor authentication adds a second step to your password – most often a code from an app or an SMS – so even if your password leaks, an attacker can't log in without it. Turn it on wherever you can, and start with your e-mail. We explain exactly how to do it, and what to do if you lose your phone, in a separate article on two-factor authentication.

Not sure about a message that claims to be from ÚVT? Don't reply to it – contact us yourself via the contacts on our website and we'll gladly check whether it's genuine. You'll find more about how we protect your connection on the UVT Security page.

Where to next

Phishing is just one of the threats. If you want your security more under control, take a look at:

How to create a secure password – the foundation that 2FA builds on.
Online security: what threatens you – an overview of threats.
Ten rules of online safety – a quick summary of the principles.

Frequently asked questions

How can I tell that a message is a scam?

Look for a combination of signs: time pressure (“within 24 hours”), a link that looks almost right but whose domain doesn't match, a request for your password, PIN or SMS code and a greeting without your name. The more of them a message has, the more certain it's a scam. If you're not sure, don't click anything and check it another way.

I clicked a link in a scam message. What now?

Act calmly, but quickly. Change the password for the affected service (and everywhere you use the same one), turn on two-factor authentication and, if payment details were involved, contact your bank through its official channel – via its app or the number on the back of your card. You'll find the step-by-step procedure above in this article.

How do I recognise a company's real address in a link?

The real address ends with the company's own domain right before the first slash. Anything added on (for example bank.verify-account.something) doesn't belong to the company. The safest option is not to click the link at all and find the website yourself.

What is two-factor authentication and why should I turn it on?

It's a second step on top of your password – most often a code from an app or an SMS. Even if your password leaked, an attacker couldn't get in without that second step. It's one of the most effective and yet simplest forms of protection; read more in the article on two-factor authentication.

I received a message in ÚVT's name. How do I check it?

Don't reply to it and don't click any links in it. Contact us yourself via the contacts on our website and ask whether the message really came from us. Always start the check yourself, not using the details given in the message.