Antiphishing.biz

Raiffeisen Bank “Digital Security Update” Phishing
Target: Raiffeisen Bank Customers (Central and Eastern Europe)
Threat Level: Critical (Raiffeisen Identity & Digital Token Theft)
Phishing Method Description
This attack targets users of the Raiffeisen Online Banking and the Digital ID apps. Scammers distribute urgent notifications via SMS (Smishing) or Email, claiming that “New Security Regulations” or a “System Maintenance” requires the user to re-verify their profile to avoid account suspension.
The link leads to a high-fidelity clone of the Raiffeisen “Login” portal. This sophisticated phishing kit is specifically designed to harvest:
Customer ID / Username
PIN / Password
Mobile Phone Number
One-Time Password (OTP) / Push Authorization: The fake site prompts the victim to enter the code from their SMS or confirm a notification in their official Raiffeisen app in real-time. This allows the attacker to authorize a fraudulent transfer or link a new device to the account instantly.
⚠️ Red Flags to Watch For
The Lookalike URL: The official domains are raiffeisen.at, raiffeisen.ro, etc. Phishing sites use deceptive addresses like raiffeisen-securitate.online, verificare-raiffeisen.net, secure-raiffeisen-login.com, or free subdomains like raiffeisen.web.app.
Urgent & Threatening Tone: Phrases like “Immediate action required” or “Your access will be blocked within 24 hours” are classic social engineering tactics.
Link in SMS/Email: Raiffeisen Bank officially states they will never include a clickable link in an SMS or email that leads directly to a login page asking for your credentials.
💡 Expert Security Tip: The “Digital ID” Proxy Attack
The Method:
This case highlights a Real-Time Authentication Hijack. Scammers are not just looking for your password; they are acting as a “middleman” between you and the real bank server.
The Trap:
When you enter your credentials on the fake page, the attacker simultaneously enters them on the actual Raiffeisen website. This triggers a legitimate Push Notification or SMS OTP to your phone. The phishing site then asks you to “Confirm the notification to finish the update.” By doing so, you are not securing your account—you are signing a digital signature that authorizes the hacker to drain your funds.
How to Protect Yourself:
The “Context” Rule: Only confirm a notification or enter an OTP if YOU were the one who manually typed the official bank address into your browser. If a prompt appears after clicking a link, REJECT it.
Read the Prompt Carefully: If the notification on your phone says “Authorize a payment” or “Register a new device” but you are just trying to “log in,” it is 100% a scam.
Zero Trust for Links: Raiffeisen will never send you a link to “Log in” or “Update” your security credentials via SMS. Always use the official Raiffeisen Smart Mobile app.

Bankinter Portugal “Security Alert” Phishing
Target: Bankinter Customers in Portugal
Threat Level: Critical (Real-time Account Takeover & SMS OTP Theft)
Phishing Method Description
This attack targets users of Bankinter Particulares (Online Banking). Scammers use a “Fraud Alert” pretext, sending out Smishing (SMS) messages claiming that an “unauthorized access” or “unusual purchase” has been detected. To “cancel” the transaction or “secure” the account, the user is pressured to click a link immediately.
The link leads to a high-fidelity clone of the Bankinter.pt portal. This sophisticated phishing kit is designed to harvest:
User ID / NIF (Número de Identificação Fiscal)
Access Password (Multichannel Key)
Mobile Phone Number
SMS One-Time Password (OTP): The fake site prompts the victim to enter the security code in real-time. The attacker immediately uses this code on the actual Bankinter server to authorize a fraudulent wire transfer or to register their own device as the primary security key.
⚠️ Red Flags to Watch For
The Lookalike URL: The official domain is bankinter.pt. Phishing sites use deceptive addresses like seguranca-bankinter.online, verificar-acesso-bankinter.net, bankinter-portugal.com, or free subdomains like bankinter-login.web.app.
Urgent & Alarming Tone: Phrases like “Acceso no autorizado detectado” or “Bloqueo preventivo” are used to bypass critical thinking and force an impulsive click.
Link in SMS/Email: Bankinter officially states they will never include a clickable link in an SMS message regarding account security or “blocking” access.
💡 Expert Security Tip: The “Cancellation” Deception
The Method:
This case highlights a Social Engineering Trick known as the “Cancellation Scam.” Scammers create a fake “security threat” to make you panic.
The Trap:
When you enter an SMS OTP on a fake site to “cancel a fraudulent transaction,” you are actually doing the exact opposite. Because the attacker is logged into your real account in the background, they have just triggered a new fraudulent transfer. The code you just entered is the final digital signature they need to move your money out of the bank.
How to Protect Yourself:
OTP is for Authorization ONLY: A real bank will never ask you to enter an SMS code to cancel or block something. SMS codes are strictly for authorizing actions you started yourself.
The “Manual Entry” Rule: If you receive a security alert via SMS, ignore the link. Open your browser and manually type www.bankinter.pt to log in safely.
Read the SMS Content: Carefully read the text accompanying the code. If it says “Code to authorize a transfer of 1,000 €” but you are trying to “secure your account,” it is 100% a scam.

OTP Bank “Account Access Verification” Phishing
Target: OTP Bank Customers (Hungary, Russia, Romania, Serbia, etc.)
Threat Level: Critical (Real-time OTP Interception & Account Hijacking)

Phishing Method Description
This attack relies on Psychological Pressure. Victims receive a Smishing (SMS) or Email claiming that their “OTPdirekt access has been suspended” or that a “Suspicious login attempt” was detected from a new device.

The link leads to a high-fidelity clone of the OTP Bank login page. This sophisticated phishing kit is designed for a Man-in-the-Middle (MitM) attack, harvesting:

User ID / Account Number (HAZ / ID)
Password / PIN
Mobile Phone Number
Mobile Signature (SMS OTP): The fake site prompts the victim to enter the 6-digit security code received via SMS in real-time. The attacker immediately uses this code on the actual bank site to authorize a fraudulent transfer or link their own device to the account.

⚠️ Red Flags to Watch For
Deceptive Domain: The official domains are otpbank.hu, otpbank.ru, otpbanka.rs, etc.. Phishing sites use lookalikes such as otpbank-security.online, verific-otp.net, or free subdomains like otp-login.web.app.
Requesting OTP for “Blocking” or “Updates”: A real bank will never ask you for an SMS code to cancel a transaction or unblock an account. Codes are strictly for authorizing actions you started yourself.
Urgent Tone: Messages demanding you “Act within 2 hours” to avoid a total block are clear signs of a scam.

🛡️ How to Protect Yourself
Use the Mobile App: Manage your security exclusively through the official OTP SmartBank or m-bank app.
The “Manual Entry” Rule: Always type the official address manually into your browser’s address bar. Never click on links in bank messages.
Verify the SMS Source: Official alerts come from registered bank IDs. If a message comes from a standard mobile number, delete it.
Immediate Action: If you have entered data on a suspicious site, call the official OTP Bank support immediately at +36 1 3666 666 (Hungary) or +7 495 783-54-00 (Russia) to freeze your account.

💡 Expert Security Tip: The “Live Proxy” Hazard
The Method:
This case highlights the Real-Time Token Relay tactic. Scammers use automated kits that act as a “live bridge” between you and the real bank.

The Trap:
When you enter your Mobile Signature SMS code on the fake site, you aren’t “verifying” anything. You are providing the final authorization for a transaction the hacker has already prepared in the background.

How to Protect Yourself:
Read the SMS Content Carefully: If the SMS says “Code to authorize a transfer of X amount” while you are just trying to “log in,” do not enter it.
Switch to Biometric Auth: Use Fingerprint or FaceID inside the official app. These methods are much harder to phish than 6-digit SMS codes.
One-Time Rule: An OTP is meant for one specific action. If the site asks you to enter multiple codes in a row for a single “verification,” close the page—they are draining your account transaction by transaction.

Banking Phishing – Fake Virtual Keyboard & Credential Harvesting

This phishing page impersonates the online banking portal of Banco BISA (a Bolivian bank). The page is designed to steal customers’ login credentials by mimicking the bank’s legitimate authentication interface.

How it works:
The victim receives a phishing email, SMS, or other fraudulent message claiming there is an issue with their account, a security alert, or a promotion. The link leads to this fake login page. The page requests the user’s “usuario” (username) and features a “Teclado virtual” (virtual keyboard) button—a common security feature used by Latin American banks to protect against keyloggers.

The twist:
Cybercriminals replicate the virtual keyboard to trick users into thinking the page is legitimate. When the victim clicks the virtual keyboard button and enters their credentials, the information is captured and sent directly to the attacker. The fake “Siguiente” (Next) button then leads to a second page that likely requests additional sensitive data, such as a password, security token, or one-time code.

Red flags to watch for:

URL mismatch: The page is not hosted on the official bank domain. Banco BISA’s legitimate online banking URL would be something like www.bisa.com or a secure subdomain—not a random or unrelated address.

Generic promotion: The footer text about “Ahorro Plus” (earning 3.85% interest) is copied from the real bank’s marketing, but phishing pages often use outdated or slightly mismatched promotional content.

Virtual keyboard context: While many banks do use virtual keyboards, phishing pages replicate them. Always verify you are on the official site before interacting with any login form.

Lack of personalization: Legitimate banking portals often display a partial account number, security image, or personal greeting after entering the username—this fake page does not.

What to do if you encounter this:

Do not enter your username, click the virtual keyboard, or press “Siguiente.”

If you are a Banco BISA customer, always type the official bank URL directly into your browser or use the official mobile banking app.

Report the phishing page to Banco BISA’s fraud department so they can work to have it taken down.

Why this scam is dangerous:
Once the attacker obtains the username and password, they can attempt to log in to the victim’s real bank account. If the bank uses two-factor authentication (2FA), the phishing site may also ask for the 2FA code on a subsequent page, allowing real-time account takeover.