Online scams in Austria: phishing, webshop and social media fraud

Online scammers often exploit the same weaknesses: urgency, curiosity and offers that seem too good to be true. The following guide explains common types of online fraud in Austria, how to recognise them and where to turn if something goes wrong.

At a glance

• A reputable company will never ask for your password or transaction number (TAN) by email.
• If you have fallen victim to phishing, contact your bank immediately and ask for your account to be blocked.
• When shopping online, avoid advance bank transfers. When buying from a private individual, insist on personal handover where possible.
• Sales between private individuals and auctions generally do not include a right of withdrawal.
• If you have been defrauded, call the police on 133 or 112.

What is phishing and how does it work?

The word phishing combines “password” and “fishing”. Scammers try to obtain confidential information, such as login details for Online-Banking, auction platforms or webshops.

You may receive an email asking you to log in to your bank’s website for a seemingly legitimate reason. However, the link leads to a fake page that looks almost identical to the real one. If you enter your details there, scammers may gain access to your account and initiate transfers. Such websites often disappear after a few hours or days, but they can cause serious damage in the meantime.

How to recognise a phishing email

The most important rule is simple: a reputable company will never ask for your password or transaction number by email. Other warning signs include:

• pressure to enter your details immediately;
• a notification about a prize even though you did not enter a competition;
• a claim that there is a security problem with your bank’s website and that you must log in for “verification”;
• a slightly different internet address, such as www.nelbanking.at instead of www.netbanking.at;
• poor German language in some cases;
• a missing or strangely changed web address after opening the page, or broken links on what should be a familiar login page.

How to protect yourself against phishing

• Do not click links received by email or other messages.
• Never reply to a phishing message. You can forward it to the company concerned or delete it.
• Only enter confidential information on an encrypted (SSL) website. Look for “https://” and the locked padlock in the address bar.
• Be particularly careful with online job advertisements involving financial tasks, such as carrying out money transfers.
• Keep your browser updated regularly.
• Some banks also allow ID Austria to be used for online banking.

If something has already happened, contact your bank immediately and ask for your account to be blocked.

Fraud on webshops and classified-ad platforms

Classified-ad and auction platforms, as well as unreliable webshops, often advertise electronic goods or branded products at prices that are noticeably low. These may be counterfeit or stolen goods. In other cases, it is simply fraud: you pay, but the product never arrives.

Pay attention to the following:

• Be cautious with offers that are much cheaper than average and compare prices.
• Check quality labels (Gütesiegel). The Austrian Euro-Label identifies checked, trustworthy webshops.
• Take extra care with webshops operating from another EU country, especially if the legal notice (Impressum) is incomplete. If only an email address is provided, do not buy.
• Read the general terms and conditions (AGB) and product description before ordering. In some cases, you may be buying only the box instead of the mobile phone.
• Avoid advance payment by bank transfer. Use a secure payment method and, for auctions, an escrow (Treuhand) system.
• Read the conditions on coupon websites. A coupon may only be redeemable under restrictions, such as a minimum order value, a particular day or a particular shop, or it may involve hidden additional costs.

Scams on social media

Popular social media platforms are also attractive to scammers. Their main aims are usually to obtain personal data through a fake login page or to spread malware. Common forms include fake fan pages, worms (Würmer) that spread when clicked, fake emails sent in the name of a social media platform, spam and unsafe applications.

What you can do

• Do not click tempting links, even if they appear to come from a friend.
• Ignore “OMG”, “Incredible” and “Amazing” style teasers.
• Before confirming anything with a click, including a competition entry, read what you are approving.
• Be careful about sharing your address, telephone number and date of birth.
• Regularly delete unnecessary applications and restrict their access rights.
• Use antivirus software that is updated daily.
• Report suspicious posts, pages and applications to the platform operator so they can be removed.

If you have already encountered a worm, delete the posts it created and check your liked pages for unusual items.

“Free” offers and threatening bills

Many websites advertise free SMS messages, games, recipes, downloads or fortune-telling. However, the costs may be hidden in the small print or in the AGB. A few weeks after a simple registration, you may receive bills, payment demands and letters from collection agencies (Inkassobüro).

In most cases, these companies have no legal basis for the claim, so do not be intimidated by threats. If you have signed up for a trial access, declare your immediate withdrawal in writing. Do not respond to payment demands; instead, contact a consumer protection organisation.

Where to get help

• Police: 133 or 112 — if you have been defrauded.
• Ambulance service: 144 — in a medical emergency.
• Your bank — after phishing, to have your account blocked.
• Internet Ombudsstelle and Watchlist Internet — for warnings, reporting scams and online disputes.
• Arbeiterkammer (AK) and VKI — for consumer protection assistance.

Watchlist Internet is a project of the Internet Ombudsstelle and also collects information about known fraudulent websites.

Frequently asked questions

Can my bank ask for my password by email?

No. A reputable company will never ask for your password or transaction number by email.

Can I withdraw from a purchase made from a private individual?

Sales between private individuals and auctions generally do not include a right of withdrawal.

Do I have to pay an invoice from a fraudulent website?

In most cases, these companies have no right to demand payment. Contact the Internet Ombudsstelle, AK and VKI.

What is the first step after phishing?

Call your bank immediately and ask for your account to be blocked. If fraud has occurred, notify the police as well.

Practical steps after an online scam

1. Stop communicating with the suspected scammer and do not click any further links.
2. Contact your bank immediately and ask for your account to be blocked if banking details were disclosed.
3. Change affected passwords and check whether unusual activity has occurred.
4. Save emails, messages, website addresses, payment records and screenshots.
5. Report the fraud to the police on 133 or 112.
6. For consumer-related problems, contact the Internet Ombudsstelle, Watchlist Internet, Arbeiterkammer (AK) or VKI.

This information is based on sources available online and does not constitute advice. If you need professional assistance, contact a lawyer, legal professional, healthcare professional, employment or labour-law specialist, or another relevant professional.

Source: oesterreich.gv.at