Spot phishing: How to uncover fake emails, SMS and links

What is phishing?

Phishing attackers pose as a bank, parcel service, shop or government agency. They send a link to a fake site via email, SMS or messenger. Anyone who enters a password, TAN or card details on that site sends them straight to the criminals.

The most common tricks

• “Your package could not be delivered” – with a link to an alleged customs fee.
• “Your account will be locked” – you’re asked to “confirm” immediately.
• “Unusual login detected” – with a button to “secure” your account.
• Sweepstakes, refunds and coupons that sound too good to be true.

How to read a URL correctly

The key part is the segment right before the suffix such as .de or .com – read the address from right to left.

• “bank.de.konto-sicher.com” belongs to **konto-sicher.com**, not to **bank.de**.
• Numbers instead of letters (“paypa1”) or letter pairs (“rn” instead of “m”) are meant to deceive you.
• Anything before an **@** in an address is ignored – the real target is what follows.
• Shortened links hide the destination completely.

Check a link without opening it

Copy the link (press‑and‑hold or right‑click → Copy link) and paste it into our Link‑Check at **performance-vpn.com/link-check**. It will show the actual destination domain and warn you about typical tricks – all within your browser, the link is never opened.

If you’ve already clicked

• You only opened the page but entered nothing: close the tab – most likely nothing happened.
• You entered a password: change it immediately – everywhere you use it. Create a strong new one with our password generator.
• You entered banking or card details: call your bank right away or block the card via the emergency number **116 116**.
• Use our Leak‑Check to see if your e‑mail address appears in known data breaches.

Does a VPN protect against phishing?

A VPN encrypts your connection and shields you from eavesdropping on public Wi‑Fi. It does **not** protect you from a fake site where you voluntarily enter information – that’s where your vigilance matters. The safest approach: always reach your bank, shop or parcel service directly through the known website or app, never via a link in a message.