# How to spot a phishing email > Five signs that give most scams away, and three real Lithuanian schemes — SMS, Smart-ID and a fake Microsoft. With diagrams of how they work, and what to do if you've already clicked. ## Why this matters to you A real story from our own clients. A company director clicked a fake link and typed in his email login. For **two weeks** the attackers quietly read everything coming in and going out — working out who he talks to, how he writes and who in the company pays the invoices. Then one day the accountant got an email from the director's **genuine mailbox**: pay **€100,000** against a pro-forma invoice. Correct Lithuanian, his writing style copied perfectly. The accountant had a bad feeling and asked the director whether he'd really sent it. That's the only reason the hijacked mailbox came to light — and a big loss was avoided. It all started with one link. Not a genius hacker — an email that looked normal. In this lesson: how to recognise one, plus two more schemes that are working in Lithuania right now. ## Sign #1 — manufactured urgency “Within 24 hours”, “immediately”, “final warning”. The scammer wants you to act faster than you think. Real institutions (your bank, VMI — the Lithuanian tax authority — or Microsoft) never demand action “right now or lose everything”. ## Sign #2 — the sender's address The name can say “Swedbank”, while the address is `info@swedbank-security.xyz`. Always look at the actual email address, not the display name. On a phone, tap the sender's name to see the address. ## Sign #3 — links Hover the mouse over a link **without clicking** — the real address appears at the bottom of the screen. On a phone, press and hold the link until the preview appears. But you also have to be able to read the address. Scammers put familiar words in it, hoping you'll only read the beginning. > **Schema.** How to read a link: in the address https://unipark.lwbtmfo.club/com the real owner is lwbtmfo.club, because those are the two words before the first slash. The word unipark at the front is only a prefix the owner can add, and /com at the end is decoration. The real address would be unipark.lt. In the same way, microsoft-login.helpdesk-lt.com belongs to helpdesk-lt.com, not Microsoft. ## Sign #4 — the unexpected attachment An invoice you weren't expecting. A “scanned document” from an unknown scanner. A ZIP file called “CV”. If you weren't expecting the attachment, don't open it until you've checked with the sender through another channel. A real case from our clients: an email with a **.zip** file attached. Inside, a PDF with a “payment link”. Clicking the link opened an infected website. The ESET web filter stopped it. > **Schema.** The layers of an infected attachment: an email with a zip archive, a PDF inside the archive, a payment link in the PDF, and the link leads to an infected website that the antivirus web filter stopped. Each layer hides the link from the mail filter and is one more place where you can stop. This time the software saved the day. But a web filter is the last safety net, not a plan: a brand-new page may not be on its lists yet. Today a common dangerous attachment isn't even a virus — it's an **HTML file**. You open the “scanned document” and a Microsoft login window opens in your browser. It looks genuine, but the address bar shows not `microsoft.com` but a file path on your own computer, e.g. `file:///C:/Users/.../Downloads/...` **You opened an attachment and a login window appeared in your browser — it's fake.** Real login pages live at a real address, not in a file on your computer. ## Sign #5 — the “boss” request CEO fraud: an email supposedly from your manager, urgently asking you to transfer money or buy gift cards. Always check with a phone call to a number you know. No real boss will be angry about a check — they'll be angry about lost money. ## “2FA didn't work” — it's not a glitch One of our clients got a notice that unread emails were waiting in his Microsoft 365 account. He clicked, entered his password, entered his 2FA code — and **“something went wrong”**. It didn't go wrong by accident. The fake page passed his password and code to the real Microsoft in real time, took the login **session** and let the scammer in. The director saw an “error” — the scammer saw his mailbox. This is called **AiTM** (*adversary-in-the-middle*) — the scammer sits between you and the real site: > **Schema.** How an AiTM attack works: you enter your password and 2FA code on a fake Microsoft page. In the same second it passes them to the real Microsoft, receives the login session and keeps it, while showing you an error. The scammer gets into your mailbox even though MFA was on. A passkey or a hardware key breaks this chain because it only works on the real Microsoft address. Two takeaways: 1. **MFA with a code isn't bulletproof.** Only passkeys or hardware keys resist this attack — there's no code to pass on. 2. **After an incident like this, changing the password isn't enough.** Tell IT so they revoke active sessions and check the mailbox rules and sign-in methods — attackers often start by setting up silent email forwarding or adding their own phone as a second MFA method. A hijacked mailbox is exactly how the story at the start of this lesson began. How to protect the company's money even when the mailbox is already hijacked is covered in a separate lesson, **[Invoice fraud: when the email is genuine](/en/lessons/invoice-fraud)**. It also has the case where a company did lose the money. ## Not just email — SMS too A real message received in August 2026. It's in Lithuanian, exactly as sent — read the explanation underneath and look for three things:
← +212 7 74 08 63 05 1
Unipark – Nesumokėto stovėjimo mokesčio pranešimas Mūsų sistemos duomenimis, su Jūsų transporto priemone susijęs stovėjimo mokestis iki šiol nėra gautas. Siekiant išvengti papildomų mokesčių ir galimų administracinių apribojimų, prašome kuo greičiau atlikti mokėjimą. Norėdami peržiūrėti savo stovėjimo sesijos informaciją, apsilankykite mūsų oficialioje svetainėje ir įveskite savo transporto priemonės valstybinį registracijos numerį. https://unipark.lwbtmfo.club/com 2 (Tiesiog atsakykite „T", tada uždarykite SMS žinutę ir atidarykite ją iš naujo, kad suaktyvintumėte nuorodą. 3 Jei nuoroda vis tiek neveikia, nukopijuokite ją ir įklijuokite tiesiai į „Safari" naršyklę.) Siekdami išvengti tolesnio administracinio nagrinėjimo, maloniai prašome kuo greičiau atlikti mokėjimą. Klientų aptarnavimo skyrius
A real scam SMS, quoted exactly. In English: “Unipark — notice of an unpaid parking fee. Pay as soon as possible to avoid extra charges… (Simply reply “T”, then close the SMS and open it again to activate the link. If it still doesn't work, copy it into Safari.)”
  1. 1 A Moroccan number (+212). A Lithuanian parking company doesn't text from Africa.
  2. 2 A fake address. The real one is unipark.lt. This one is lwbtmfo.club, and the “/com” at the end is only there to fool your eye.
  3. 3 The cleverest part. iPhones disable links from unknown senders. Sigitas the scammer is asking you to switch off your phone's protection yourself. No real company ever sends that sentence.
## When the fake looks perfect This email landed in our own mailbox. At first glance, a tidy notice from Paysera (a Lithuanian payment company) about an AML/KYC check:
Outlook2026-08-04 09:12
ΑΜL/ΚΥС геіkаlаvіmаі – раtvігtіnkіtе tараtуbę 1
Ρ Ρауѕега Сһесk
siska@gmmobil.com 2
To: antanas@itbroliai.lt
Gerbiamas kliente, vykdydami pinigų plovimo prevencijos reikalavimus, privalome pakartotinai patvirtinti Jūsų tapatybę. Pagal sutarties 2.13 punktą 3 nepatvirtinus per 10 darbo dienų, paslaugos gali būti apribotos. Patvirtinti tapatybę: һttрѕ://www.рауѕега.соm/lt/раtvігtіntі 4 Užklausos Nr.: KEB-147-__PROT0__ 5 UAB „Paysera LT", Pilaitės pr. 16, Vilnius · +370 5 2071 558
🖱 Hovering reveals the real link:
google.com/share.google?q=7PZFAudJ2yA73JkEn
Five techniques in one email, quoted exactly. In English — subject: “AML/KYC requirements – confirm your identity”; body: “Dear customer, under anti-money-laundering requirements we must re-confirm your identity. Under clause 2.13 of the agreement, if you don't confirm within 10 working days, services may be restricted. Confirm identity: … Request no.: KEB-147-__PROT0__”.
  1. 1 Letters that aren't letters. The whole subject line is written in Greek and Cyrillic characters that look identical. Filters see gibberish; you see “AML”.
  2. 2 The address doesn't match the name. “Paysera Check” is writing from gmmobil.com.
  3. 3 Invented legal authority. The contract clause doesn't exist — but it sounds serious.
  4. 4 Text ≠ link. The visible address says paysera.com, but it actually goes through a Google redirect.
  5. 5 And here they slipped up: __PROT0__ — an unfilled template variable. Automation always gives itself away somewhere. Read the small print.
The first sign is worth a closer look. This is what the sender's name is really made of: > **Schema.** Homoglyphs: the sender name Paysera in the email contains not a single Latin letter. The first letter P is a Greek rho, and the other six are Cyrillic letters that look like a, y, s, e, r and a. To a person the word looks identical, but to a computer it is a completely different word. ## A second SMS scheme: customs fees and your card Same mechanics, different bait — and a different prize.
← Lietuvos paštas
Jūsų siunta iš AliExpress sulaikyta muitinėje. Norėdami gauti siuntą, sumokėkite muito mokestį 1,50 EUR: https://post-lt-muitas.info/pay
A retold scheme, in Lithuanian as it arrives. In English: “Your parcel from AliExpress is held at customs. To receive it, pay a customs fee of 1.50 EUR:” — supposedly from Lietuvos paštas (Lithuanian Post). The page looks almost like post.lt.
The page that opens looks very like the real one. It asks for your **card details**. Enter them and €1–2 is charged, with a message that everything went through. Congratulations: your card details have been stolen. ## Why the small amount is the cleverest part The €1.50 isn't what the scammer is after. It's a **card check** — making sure the card works and the details are correct. The real losses come later, or the details are sold on. The amount is chosen deliberately: **nobody calls the bank over one euro fifty.** Silence is exactly what they need. Two rules: 1. **A customs fee is never paid by typing card details into a link from an SMS.** The real post office charges fees through its own website or app, once you've logged in. 2. **Entered your card details → block the card now**, in your banking app, without waiting until morning. It takes seconds and can be undone. The scheme works because almost everyone orders something from AliExpress or Temu — the message lands on a real expectation. Before holidays these messages peak. ## The fix: virtual cards with limits It's hard to protect yourself from the messages — they'll keep coming. But you can make stolen card details almost worthless. ## What that message cost The same Unipark scheme, a real case. A company owner clicked the link, **confirmed a Smart-ID request**, and saw on screen that everything was fine. Some time later he noticed a **five-figure sum** had gone from the current account. He didn't type a single password for the scammers. He just confirmed. ## A Smart-ID confirmation is a signature This is the most important part of the lesson. Smart-ID (the app most people in Lithuania use to log in to their bank and sign documents) always shows **who** is asking for confirmation and **what for**. The scam page connects to your bank at the same moment — so a genuine bank request appears on your phone. You're thinking about a parking fee, while you're confirming a login to your bank. > **Schema.** How the Smart-ID scam works: a fake parking-fee page asks for your licence plate and personal ID code, and in the same second uses your ID code to log in to your bank. The bank sends a genuine Smart-ID request to your phone. You confirm it, thinking you are paying for parking. The bank lets the scammer in, and the fake page shows you that the fee is paid. The “everything's fine” message afterwards comes from the fake page, not the bank. The only moment the scam is visible is on your phone screen: > **Schema.** Expectation versus reality: on the page you expect to pay a parking fee, while Smart-ID on your phone asks you to log in to your bank. When what you expect doesn't match what you're asked, reject the confirmation. Four rules: 1. **Read who is asking and what for.** Not “confirm”, but *who* and *what* you're confirming. Expected Unipark, but Smart-ID shows your bank? Stop. 2. **A matching verification code proves nothing.** The fake page simply copies it from the real bank — during an attack the codes will match. 3. **Expected one thing, asked for another** (expected parking, asked for a bank login) → stop. Not later — that second. 4. **Go to your bank only from its own app** or by typing the address yourself. Never from an SMS. By the way, the story doesn't say why the daily and monthly limits didn't kick in. So take the hint — **check your own limits today**. For most people they're set far higher than they actually need. ## Not sure? Ask AI You don't have to decide alone. AI is very good at spotting exactly what the human eye misses: fake letters, mismatched domains, pressure wording. At the top of the lesson there's a “Learn with AI” button — it copies the whole lesson together with instructions. Paste it into an AI and add your suspicious email right there. ## What to do with a suspicious email 1. Don't click links or open attachments. 2. Report it to your IT team — or to us: **pagalba@itbroliai.lt** (forward the email as an attachment so the headers are kept). If it's urgent, call **+370 618 05093**. 3. Delete the email. 4. **If you've already clicked** — tell IT, but you don't need to change your password yet: clicking a link alone doesn't reveal it. **Change your password only if you typed it** into the fake page — whether or not the login seemed to work. Then change it straight away, everywhere you used the same password, and turn on MFA. Reporting is never embarrassing. Staying quiet is. ## Check yourself Ten questions on what you've just read. At the end you'll get a certificate with your score — you can add it to your LinkedIn profile.