What is Phishing and how to prevent it?

Phishing is a common scam where criminals pretend to be a trusted company or person to steal your information or money. It can happen through emails, text messages, phone calls, social media, QR codes, or fake websites.

This guide explains how phishing works, how to recognize common warning signs, and what to do if you receive a suspicious message.

1. What is phishing?

Phishing is a deceptive message, email, website, or phone call designed to trick you into sharing sensitive information or sending money.

Fraudsters may try to obtain:

• One-time verification codes: SMS codes or other codes used to approve an action or access an account.
• Card details: Your card number, expiration date, and CVV/CVC.
• Passcodes: Your device or myTU app passcode.
• Personal information: Identity details or other information that may be used to access your accounts.
• Money transfers: Payments to an account controlled by a fraudster.

2. Common types of phishing

SMS phishing (smishing)

• Fake parcel fees: A text message claims that you need to pay a small customs or delivery fee before a package can be delivered.
• Fake security alerts: A message claims that your account has been suspended or that an unfamiliar login requires immediate action.
• Unexpected links or QR codes: The message asks you to open a link, scan a QR code, or enter your information on a website.

Marketplace and buyer scams

• Fraudsters may pose as buyers on marketplaces such as Vinted, Wallapop, eBay, or Facebook Marketplace.
• They may send a fake payment or delivery link and ask you to “receive payment” or “verify your card.”
• You should never need to share your card details or a one-time verification code to receive money from a buyer.

Phone-call phishing (vishing)

• A caller may pretend to be from myTU, another financial institution, the police, or a public authority.
• They may claim that your funds are at risk, a payment must be canceled, or your account requires urgent verification.
• They may ask you to share a verification code, approve an unexpected request, transfer money, or install remote-access software.

Do not rely on caller ID alone. If a call is unexpected, end it and contact the organization independently through its official app or website.

3. Warning signs to look out for

• Urgency or pressure: Threats that your account will be blocked, your funds will be lost, or a package will be returned unless you act immediately.
• Suspicious links: Website addresses with spelling mistakes, extra words, or an unfamiliar domain ending.
• Requests for secret information: Anyone asking for your passcode, one-time verification code, card details, or CVV/CVC.
• Off-platform payment requests: A buyer or seller asks you to open an external payment link or continue the transaction outside the marketplace.
• Remote-access requests: Someone asks you to install screen-sharing or remote-control software on your phone or computer.

A padlock icon or https in a web address does not prove that a website is genuine. Do not enter your details after following an unexpected link.

4. What to do if you receive a suspicious message

• Do not click links, scan QR codes, download attachments, or reply.
• Do not share verification codes or card details.
• Do not use contact details included in the message. Find the organization’s official contact details independently.
• Report and block the sender. Use the reporting tools available in your email provider, messaging app, or marketplace platform.
• Keep evidence if you have interacted with the scammer. Save relevant messages or screenshots before deleting them.

5. What to do if you clicked a link or entered details

Clicking a link does not always mean that your account has been compromised. However, stop interacting with the website immediately and take action based on what happened.

1. If you entered card details or notice unfamiliar card activity: Open the myTU app, go to Cards, select the affected card, and tap Block.
2. If you shared a verification code, passcode, or approved an unexpected request: Contact myTU Support immediately.
3. If you only clicked a link: Close the website, do not enter any information, and do not download or install anything.
4. Contact myTU Support:
   • Use in-app chat through the myTU app; or
   • Email support@mytu.co.