Email Scams, How to Tell if an Email Is Fake and What to Do

Email scams are messages that try to trick you into handing over passwords, card details or money, or into opening a file that will infect your computer. A new scam method appears almost every week, and scammers thrive because internet users are highly exposed but poorly informed.

Konet has been running mail servers since 1999, so we see first-hand what reaches our customers' inboxes and how scams change. There are so many kinds that they cannot fit in one article, so here we cover the ones that matter most to everyday users and businesses, with a focus on Greece: how to recognise them and what to do if you fall victim.

What is a phishing email

A phishing email is a fake email that imitates someone you trust, such as your bank, the tax office, a social security agency or a courier company, to get your details or your money. The word comes from "fishing", because the scammer throws bait at thousands of recipients and waits to see who bites. It is the most common form of cybercrime: in 2025 alone the FBI received 191,561 phishing and spoofing complaints, more than any other category.

Email scams appeared almost as soon as email itself. When email spread in the early 1990s (in Greece about a decade later), malware was still simple and mostly destroyed files or parts of the operating system. Spyware came later, so scammers relied on emails that persuaded the recipient to reply or send money.

The best-known example is the "Nigerian prince". In this email, the supposedly exiled heir of a Nigerian royal dynasty asked the recipient for financial help to start the process of claiming his family's great fortune. The help was usually very small (100 to 200 dollars) compared with the amount the supposed prince promised to share with whoever helped him (40 to 100 million dollars). Another well-known example is the lottery. A company, usually in an overseas country, had held a lottery that by pure chance included your name and email address, and you had won many millions of dollars. All you needed to collect them was to pay the transfer fees, and the company was always happy to handle everything, as long as you sent the fees to them instead of directly to the bank. These scams may look crude and cheap today, yet quite a few people fell for them and sent money, because they did not understand the risks of this new form of communication. Email scams continue today, and every day, among the many spam messages we receive, there are malicious ones. The difference is that they are now far more polished, with correct language, logos and pages that look identical to the real ones.

How to tell if an email is fake

How do you tell if an email is fake? The signs below are also listed by Google and Microsoft, and the more of them you see in an email, the more certain it is a scam:

• It asks for passwords, PINs or card details. No bank or serious organisation asks for these by email.
• It puts you under time pressure. "Your account will be locked in 24 hours", "Deadline 30 September". The rush is there so you do not stop to think.
• The sender name does not match the address. It shows a bank's name but the domain after the @ is unrelated, or a domain that looks like the right one, such as govgre.eu instead of gov.gr.
• The link does not go where it says. Hover over the link without clicking and look at the address that appears. You will find more about this in part two, on phishing links.
• It has an unexpected attachment. An invoice, product catalogue or "receipt" you were not expecting, often in a compressed file.
• It promises something too good to be true. A refund, a prize, a gift or a discount in exchange for your bank details.
• It addresses you generically. "Dear customer" instead of your name.

One point needs particular care, because we see it often on our servers. Both the name and the address you see in the "From" field can be forged. We have seen emails showing the name and the real email address of a Greek bank that never left the bank but came from a server in Austria. So the sender address is not enough on its own, and the only way to see where an email really came from is its headers.

How to see the real sender in the email headers

Email headers are the hidden information that comes with every message and records its route, from the server that sent it to yours. They show the real sender address and the IP of the server it came from, while the name and address in "From" can be whatever the scammer wants. According to Google, you view the headers like this:

• Gmail: open the message, click "More" next to "Reply" and then "Show original".
• Outlook: open the message, click "File" and then "Properties". The headers are in the "Internet headers" box.
• Thunderbird: "View" menu, then "Message Source".
• Apple Mail: "View" menu, "Message" and then "All Headers".

In the headers, look at three things:

1. Return-Path. This is the address undelivered messages go back to, and it often reveals the real sender. If "From" says a bank and the Return-Path is an unrelated domain, it is a scam.
2. Received. Every server the message passed through adds a Received line. The lowest line is the server that sent it first, and the lines added by your own server cannot be changed by the sender.
3. Authentication-Results. This shows the SPF, DKIM and DMARC checks, meaning whether the sender's domain allows that server to send email on its behalf.

But be careful: a "pass" for SPF and DKIM does not mean the email is from the bank. It only means it was sent correctly from the domain shown in the check, and that domain may have been registered by the scammer. Many campaigns that imitate Greek banks and gov.gr are sent through large, legitimate email sending services, with constantly changing domains that pass every check. So always look at which domain the "pass" refers to, not just whether there is one.

Email scams from tax and social security agencies

Email scams pretending to come from the tax office, social security (e-EFKA), the national health insurer (EOPYY) or gov.gr are among the most common in Greece, because we all expect a message from the state at some point. These emails ask for bank and personal details, for a "refund", a "data update" or so you do not lose some entitlement. But the state already has your details, and if there is a real issue, you will see it when you log in to the agency's platform yourself, typing the address rather than clicking the link in the email.

A recent example is the fake emails in the name of e-EFKA, which the Hellenic Police Cyber Crime Division warned about in April 2026. They said you could not use your health card because your details were out of date, and sent you to a link to "update" them through your bank. As the Division points out, e-EFKA never asks for data verification by email or links.

Bank email scams

A bank email scam asks you to confirm your details, "unlock" your account or approve a transaction, and sends you to a page that looks identical to online banking. No bank asks you to confirm your details by email. As soon as you enter your credentials and the one-time password (OTP) you receive by SMS, the scammer gets into your account and transfers money.

On our mail servers we often see emails using Greek banks as the sender name. In September 2026, for example, a campaign with the subject "Data update 2026, deadline 30 September" was sent from compromised websites at a UK hosting provider. The first message got through the commercial filter, because technically it looked like a normal email. We stopped it with the internal security tools we have built on top of the commercial ones, which check whether an email using a bank's name really comes from that bank's domains. Of the 39 messages that arrived from that source within a few hours, all 39 were phishing.

The problem is real in Greece too. In its 2025 review of the Cyber Crime Division, the Hellenic Police reports that it dismantled a ring of at least 80 people that had used phishing against 537 customers of a Greek bank, with illegal gains of about 534,000 euros.

Courier and online shop email scams

A courier email scam, in the name of the Hellenic Post (ELTA), ACS or another courier, tells you that a parcel could not be delivered and that you need to pay a small amount for fees or customs. The amount is small so you do not think twice, but the target is not the 2 euros, it is your card details. If you are expecting a parcel, go to the company's site by typing the address and enter the tracking number, never through the link in the email.

The same goes for emails that seem to come from well-known shops and companies. It is normal to receive coupons and offers if you have given a company your address. But when an "offer" asks for your bank details to give you the discount, it is a scam. Also watch out for emails with attachments that supposedly contain product catalogues from large companies, and for links that look like .jpg or .png images. In reality the link does not lead to an image but to an executable file (.exe), and as soon as you open it, it installs malware on your computer.

Another common type imitates your email provider. It tells you that your mailbox is full or that your account will be deactivated, and asks you to log in to "fix" it. The login page is fake and your password goes to the scammer, who then sends spam from your address.

Business email scams and the changed bank account

Business email scams are the most expensive of all. The scammer gets into a company's email, watches its correspondence with customers and suppliers and, just as a payment is due, sends an email saying "our bank account has changed". This is called Business Email Compromise (BEC), and according to the FBI report for 2025 it caused losses of more than 3 billion dollars in a single year. We give all our customers the same rule: confirm every bank account change by phone, on a number you already know. You will find the details of how it works and how to protect yourself in our article on malware and the changed bank account scam.

To stop anyone sending email with your business address, set up SPF, DKIM and DMARC on your domain, and turn on two-step verification for every email account.

How to protect yourself from internet scams

It is a fact that spam and email scams are growing, and growing fast. To protect yourself there is one and only solution: constant awareness! The internet does not stand still, and neither does technology. The only way to stay safe is to learn about it and take precautions, both for yourself and for your family:

1. Stay informed. Prevention is always better than cure, and anyone who knows how scams work recognises them at first sight.
2. Ask your email provider for filtering. A good spam and fraud filter stops most of these emails before they reach you. If you use Gmail or Outlook.com, filtering is already there. On Konet's Semi Dedicated Hosting plans, email goes through the SpamExperts filter for both incoming and outgoing mail, and our own internal security tools also run on our servers.
3. Install a complete security suite. Not just antivirus or antimalware, but a full suite (Total Protection) that also checks emails and the pages you open. A good suite costs about the same as a coffee a month. We do not trust free programs, and we explain why in our malware guide.
4. Do not reply to spam. Replying confirms to the sender that your address is active, and you will receive even more. See the right way to deal with spam.
5. Do not click links from senders you do not know personally, even if they look safe. There have been many cases where hackers broke into companies' servers, created malicious emails and sent them to all of the companies' customers, with the bad results you would expect. If an offer from a shop interests you, call the shop to confirm it really exists, or go to its site yourself.
6. Learn to check the real sender in the headers. As explained above, that is where the real address and the IP the email came from are shown.
7. Turn on two-step verification. Even if the scammer gets your password, they cannot get into your account without the second factor. Your password should also be unique for every account, as we explain in strong password.

I fell for an email scam, what should I do

If you fell for an email scam, act immediately, because every minute counts. Follow the steps in order:

1. If you gave bank or card details, call your bank immediately. Call your bank's fraud line, which at many banks works around the clock. Ask them to block the card and the transactions, because the faster you act, the better the chance of the money being frozen.
2. Change the password of the account you gave away, from a device you know is clean, and on every other account where you used the same password.
3. Turn on two-step verification and check the recent sign-ins on your account.
4. If you opened an attachment, run a full scan on your computer, as described in what is malware.
5. Keep the email, with its headers, and screenshots of what you saw. You will need them for the report.
6. Report it to the police, as explained below.

In Greece, if your account was charged with a transaction you did not approve, Law 4537/2018 provides that you notify the bank without delay and no later than 13 months from the charge. The bank must prove that the transaction was carried out with strong authentication, and in recent years many court rulings have ordered banks to refund phishing victims. Every case is different, though, so speak to a lawyer about yours.

Reporting an email scam to the police

For any email scam that cost you money or data, report it to the police. In Greece you report it to the Hellenic Police Cyber Crime Division. Reporting is free and, according to the National Register of Administrative Procedures, you can do it:

• by phone on 11188, around the clock,
• by email at ccu@cybercrimeunit.gov.gr,
• online at gov.gr, with TAXISnet or web banking credentials,
• in person or by post, at 173 Alexandras Avenue in Athens or 326 Monastiriou Street in Thessaloniki.

Reporting is not a formality. In 2025 alone, the Division opened 7,834 online fraud cases, froze about 4.86 million euros and returned 4.21 million euros to victims, according to its 2025 review. New scams are also announced on cyberalert.gr. Outside Greece, report it to your national police cybercrime unit.

Cases involving children, such as grooming, or blackmail must be reported immediately, without any delay. The same goes for every email that imitates a bank or a public agency, even if you did not fall for it, because reporting helps stop the campaign before others fall victim. For the rest, such as the "Nigerian prince", blocking the sender and deleting the email is enough.

So stay informed and protect yourself from internet scams. If you receive an email and are not sure whether it is a scam, and your email is hosted with us, open a support ticket and we will check it with you.