Most break-ins don’t start with hacking. They start with an email that someone opened and clicked.
Not because they are stupid — because the email looked real and arrived at a moment when they were in a hurry.
1. Urgency that can’t wait
“Your account will be closed in 24 hours.” “Confirm your details urgently.”
Real institutions don’t work like that. A bank with a problem with your account will call you or send a letter — it won’t give you a one-day deadline by email.
Urgency is a tool. The aim is to stop you from thinking.
2. The sender’s address — not the name
The display name can say anything. Look at the actual address.
Komercijalna Banka <noreply@kb-security.info>
The name is fine, the domain isn’t. Watch for small differences: rn instead of m, a zero instead of an o, an extra hyphen.
3. A link that doesn’t go where it says
Hover the mouse over the link — the browser shows the real address at the bottom left. On a phone: press and hold.
If the text says yourbank.com but the address at the bottom is something else — close the email.
4. An attachment you weren’t expecting
Especially .zip, .exe, or a Word document that asks you to “enable macros”. That request is almost always an attack.
An invoice from a company you don’t work with? Don’t open it — the urge to check “what is this” is exactly what they are counting on.
5. A request for data they already have
Your bank knows your details. It doesn’t need an email to “confirm” them.
No serious institution will ask for your password, PIN or full card number — not by email, not by phone.
6. Language that sounds off
Odd translations, clumsy grammar, strange spelling or the wrong alphabet. Not always — some are perfectly written — but when it is there, that is enough.
If you have already clicked
Don’t panic, but act straight away:
- Change the password — from a different device, if you entered it on a suspicious page
- Turn on two-factor login
- Call your bank if you entered card details
- Warn your colleagues — usually everyone got the same email
The best protection isn’t technical
A company rule: no request for money or data is carried out on the strength of an email alone. Call the number you already know — not the one in the message.
That one habit stops almost everything.
Want someone to keep an eye on things for you — updates, backups and monitoring?
Maintenance →