Email Scams (Phishing)
See what scammers are sending right now, the red flags to spot, and what to do next.
Watch out for:
- When the language is urgent or threatening.
- There are unexpected attachments such as PDF’s, HTML’s or ZIP’s.
- The sender domain does not quite match the genuine domain.
- There are requests for OTP’s, PINs or Bank Login Details.
- You are asked to call a number that differs from your personal bank details.
- You are asked to verify or re-activate your expired password.
REAL LIFE EXAMPLES:
Below you will see the Red Flags to watch for. Advice (in italics) is sometimes given in the email.
From: Nedbank <myestatements emrb@optionsmedia.gr> (look closely, because usually the email address is suspect)
Subject: Nedbank Customer Statement 2683 – 12112025
What it claims:
Dear Valued Customer, We have attached your latest Nedbank Statement. |
If you do not have a PDF viewer, you can also access your statement via our digital channels.
|
Regards, Nedbank Digital Service This email may have information that is confidential, privileged or may not be disclosed. If you are not the intended recipient, please do not duplicate or resend this email. Delete it and let us know that you have received it by mistake. |
Action required: Click on the PDF, which is supposedly your statement. Don’t do it!
From: MWEB <mazpet@mweb.co.za> (look closely, because usually the email address is suspect)
Subject: Important: Late Mail Delivery – yourname@email.co.za
What it claims: Mail quarantine filter has blocked the delivery of 3 emails to your inbox.
You can review these here and choose what happens to them.
Emails will be deleted automatically soon. Urgency is a red flag!
Action required: “Review Quarantined Messages Now” which involves you clicking on a link. Don’t do it!
From: The Courier Guy TC@dentalcare-itodc.com
Subject: Final Step to Get Your Parcel Delivered.
What it claims: Shipment 6K7WZL: At destination hub
Dear Customer,
Your parcel (Tracking No. TCG002330314) is on hold pending customs Payment & Address Verification.
Parcel ID: JD014600011161686430
Declared Value: R112.32
Status: Payment & Address Verification Required
Action required: “Track & Confirm” button, which involves you clicking on the button.
What will happen if you do: you will be directed to a payment portal and they will steal your credit card details.
From: Frederic FromNetlflix a través de Smartsheet user@app.smartsheet.com
Subject: See more details here:
What it claims: Dear,
We could not authorize your payment for the next billing cycle of your subscription therefore we’ve suspended your membership. But your current subscription is active until it expires.
Haga clic para abrir el formulario que he compartido con usted:
Action required: “See more details here” button, which involves you clicking on the button.
What will happen if you do: you will be directed to a payment portal and they will steal your credit card details.
From: Investec BOP Reporting pbclientliaison@casinohotelgoin.com
Subject: Foreign exchange transaction is completed
What it claims: Dear Client,
Following the completion of your foreign exchange transaction, your Investec Private Bank Account will be debited.
If you have any queries, please contact our 24/7 global Client Support Centre on 27 11 286 9663.
Regards,
Investec
Action required: Call the number given in the email.
What will happen if you do: you will be asked for your bank details. Don’t do it!
From: …….WED……. era@bonniebaby.co.uk
Subject: Attn: winner
What it claims:
View attached winning notification and contacts your fiduciary Agent
For your prize
Regards
Action required: Click on the attached document (PDF).
What will happen if you do: You will be directed to a website where you will be relieved of your personal details including your bank details. Don’t do it!
From: Peggy Chan <peg00023@utexas.edu>
Subject: Attn: winner
What it claims:
Hello,
I trust you are doing well? I have a business of $27.6 million, I need your help to succeed in this business.
My proposal includes a detailed outline of the business idea, 50% each mutual benefit. I am certain that this partnership will be lucrative and successful.
I would appreciate the opportunity to tell you more about this proposal further at your earliest respond.
Best regards,
Peggy.
Action required: Reply to the email. Think carefully: why would Peggy, an unknown person, be reaching out to YOU?!
From: Reminder wester@gungary.com.de via mta08-dc01.cm.synaq.com
Subject: Final-Reminder(#1561036):Payment-required to prevent account suspension!
What it claims:
FINAL REMINDER: Your Total AV Protection Expires Shortly (Urgency is a red flag) |
Total AV Ultimate Protection Subscription • Automatic Cancellation Imminent |
Dear Customer, | ||||||||||
We have contacted you multiple times regarding the upcoming expiration of your Total AV Ultimate Protection subscription. However, we have not yet received any response from you. | ||||||||||
| ||||||||||
| ||||||||||
| ||||||||||
Final opportunity – Continue to ensure comprehensive protection! | ||||||||||
Action required: Click on the red button to Renew your subscription!
What will happen if you do: You will be directed to a website where you will be relieved of your personal details including your bank details. Don’t do it!