See how fraudsters run phishing scams, so you can learn to spot their tricks

The internet can be an amazing place. But unfortunately it can also make it easy for fraudsters to create incredibly convincing scams.

So we want to take you behind the scenes of one of these scams. So you can see how fraudsters run them, and learn to spot their tricks.

We'll explain how phishing scams work, how fraudsters can set up websites that look so convincing, and how they actually take your money. So next time you come across a scam, you'll know how to spot it.

It's happened to most of us. You get a text out of nowhere saying HMRC owes you money. The message asks you to click a link to get what they owe you.

The link isn't a website you normally go to, but it does have "HMRC" in it.

You click it, and the website it takes you to looks legit. So you fill out your details and go on with your day.

A bit later, you see some unexpected spending on your account and realise you've been scammed 😞

We call this type of scam "phishing."

The first thing you'll probably notice is who the text is from. You can see it in your phone as "HMRC."

This already makes the message pretty believable: you can trust the sender name, right?

Sadly, no. The text message system was built a long time ago, and doesn't have any of the security features we'd include if we designed it today. The first text message was sent in 1992!

The person sending the text message can control who you think it's from. And they can actually choose any name they want!

⚠️ So when you get a text message, you can't actually trust the sender name or number at all!

What about the link in the message: "hmrc.tax-refunds.org/login"?

This certainly looks authentic: it's clearly to do with tax refunds and it also includes "hmrc," which you'd expect.

So how did the scammers get such a convincing link?

First lets do a tiny bit of ICT revision on what makes up a link (technically called a URL or Uniform Resource Locator):

The most important part of a link is the "root domain" (here it's "tax-refunds.org").

The "root domain" is a series of letters, numbers, and dashes. Plus a short extension called the "top level domain" (here it's ".org" but there are many others like .com, .co.uk, and .net).

This "root domain" is the thing you buy when you're setting up a website.

Some top level domains can only be used by specific people. For example:

But most top level domains are available for anyone to buy (just as long as someone else doesn't already own it).

So the scammers were able to buy "tax-refunds.org" without anyone checking what they're using it for.

Once you own a root domain, you can create as many "sub-domains" and "paths" as you like.

In this case, the scammers added "hmrc" as a sub-domain to create "hmrc.tax-refunds.org." Adding "hmrc" makes the link look legit, especially at a glance. And they could just have as easily created "hmrc.gov.uk.tax-refunds.org," which looks even more convincing!

In the same way, scammers also sometimes add "paths" onto root domains to mimic credible websites. For example: "tax-refunds.org/hmrc.gov.uk".

Let's use gov.uk/claim-tax-refund as an example of a site a fraudster might want to mimic. What links could a fraudster make to try and trick you into thinking their site was real?

Using paths and subdomains like this means scammers can make their links look surprisingly real. And as you can see, spotting if a link is safe can be very tricky.

⚠️ So remember, just because a link includes words or websites you're familiar with (like "gov.uk"), it doesn't mean they're real!

What usually makes phishing scams so believable is just how convincing the fake websites can look.

Take a look at these websites. Which one is the real deal? And which ones are scams?

Number 3 is the only real one!

Don't feel bad if you got it wrong. As you can see, the fake sites are almost identical to the real thing: they all use the same logo, the same fonts, and the same buttons.

Fraudsters make their sites look as close as possible to the real thing, so you don't get suspicious when they ask you for your sensitive details.

To do this, they take a clone of the real site and then edit it slightly, so that it asks for information like your PIN or email password.

Cloning websites sounds very technical. But if you're reading this on a laptop or desktop, then you're using a super powerful website cloning software right now!

If you click "File → Save As" your web browser will download a complete copy of this page. You might use this feature to save things to read later. But it's unfortunately also very easy for fraudsters to use this file to create a phishing site.

⚠️ So remember, you can't trust a website just because it looks like a legitimate one you've used before.

It's very easy for fraudsters to use the same logos, fonts and buttons to make their fake sites look like the real thing.

A fraudster running a phishing scam wants to get as much information about you as possible, so they can make money off you.

They'll be interested in getting information like:

The most obvious thing on this list is your card details. With your card number, expiry date, and CVC in hand, fraudsters can go on an online shopping spree and buy anything they want with your money.

The rest of the list is a bit less obvious though. Why would a fraudster want your email address and password? What can they realistically do with all those unread email newsletters?

Fraudsters want access to your emails because so much of your online life depends on your email account. If someone else has access to your emails, they could reset your passwords for your other online accounts and log in there as well.

If a fraudster's able to log into your online banking, they could transfer all of your money to their own account. They could even apply for a massive loan and steal all of that as well 😞

What if you start filling out your details, but part way through realise it's a phishing scam and stop? Can you rest easy knowing you didn't enter your card details or give up any passwords?

Not quite! Even though the fraudsters didn't get information they can use to take your money straight away, they still learnt a lot about you.

Even if you didn't fill out all the information they asked for, or click 'submit', you have to assume the fraudsters know everything you typed into the phishing site.

They could know your date of birth, your home address, your mother's maiden name, and anything else you filled out before quitting.

Armed with this information, they can craft an even more convincing phishing attack that's customised just for you!

If a fraudster has some sensitive information about you, they'll sometimes phone you up pretending to be the police, the government, or even your bank's fraud team. They'll use all the information they know about you to convince you they're legitimate.

Once they convince you, they'll try to trick or pressure you into sending your own money to another account!

Because they know so much about you, they can seem very credible. When you hear them tell you all sorts of information about yourself, it's hard not to believe that they are who they say they are. If they know your bank account number and your mother's maiden name, surely they must be from your bank!

Fraudsters can even spoof their phone number so it looks like they're really calling from the government or your bank. Just like with text messages, you can't trust the phone number on a call either!

A spoofed phone call from a fraudster might happen really soon after you fill out your details on a phishing site, or it could be weeks later.

This type of scam (where you're tricked into giving away your own money) is known as authorised push payment (APP) fraud.

Getting your money back can be very difficult if you’ve been scammed into sending it to another account. Bank transfers are instant, meaning they're almost impossible to cancel. And the fraudster can quickly move the stolen money elsewhere before they’re caught.

It might be disturbing to realise just how sophisticated some fraudsters can be.

There are security teams all over the world looking out for phishing sites and getting them removed before you even see them. At Monzo, we scan about 12 million websites every single day to find and get rid of phishing sites!

Once we've found a phishing site, it can take a while for it to be taken down. We have to coordinate with the companies running the website to make sure they're taking it down for legitimate reasons. And this process often takes a few hours, or sometimes even days.

The good news is that there's some easy steps you can take to keep your accounts secure, even if you do fall for a phishing scam.

Your email account is the gateway to the rest of your online life. So keep your email password extra safe! 🔐

There's no reason for any website to ask for your email password, except for your actual email provider.

If you have a Monzo account, we'll never ask for your email password.

If you set up 2FA, even if you fall for a phishing scam and tell a fraudster your password, they still won't be able to log into your account!

Most email providers offer this feature. If you turn on 2FA, whenever you log in to your email account, you'll need to give two pieces of information to log in:

Here are some guides on how to turn on 2FA with common email providers:

If you click on a link and see a warning like this, listen to it!

It's extremely unlikely that the site you're visiting is real. Your browser will show you these warnings when people have reported that a website's malicious, but they haven't taken it down yet.

Just remember, if you don't see a warning, that doesn't mean the site's real. Always take a good look at the link to decide if you trust it.

Fraudsters make their messages sound very urgent and alarming, to try and panic you into believing them before you realise it's a scam.

Real companies won't try to rush or panic you. So if you suspect a message might be phishing, it's always better to reach out to the company that supposedly sent it to double-check if it's real.