You get an email. Subject line: "Urgent: your bunq account has been temporarily limited." The logo looks right. The tone sounds professional. There's a button asking you to verify your details.

Your heart rate goes up. You click.

That's how phishing works. Not through hacking your device, but through one moment of anxiety that happens before your brain catches up. Here's everything you need to know to make sure it doesn't work on you.

What is phishing?

Phishing is when a scammer impersonates a trusted company (your bank, a delivery service, a government body) to trick you into handing over personal details. A password, a card number, a one-time code. Whatever gets them in.

It happens over email, SMS, phone calls, and fake websites. The format changes. The tactic doesn't: get you to act fast, before you stop to think.

Phishing email examples

These are the most common phishing email examples in circulation right now. Fraudsters reuse these templates constantly because they keep working.

The "suspended account" email

Subject: Urgent: Your bunq account has been temporarily limited
From: support@bunq-secure-help.com

It's designed to get you clicking before you've finished reading it. The sender looks plausible at a glance, and clicking through takes you to a fake login page built to capture your credentials.

The giveaway is the sender domain. bunq's only official email addresses come from bunq.com and help.bunq.com. Anything with a hyphen, a prefix, or an extra word is fraudulent, regardless of how convincing the logo looks: bunq-secure-help.com, mybunq.co, bunq.login-portal.com.

The "unusual payment" email

Subject: Action required: unusual transaction detected on your account
From: no-reply@bunq-alerts.net

This one is clever because it mimics something real. There's a transaction you don't recognize and a link to "confirm or cancel" it. Click through and you're asked for your login, sometimes your card details too.

The sender domain is the first tell: bunq-alerts.net isn't bunq. The bigger issue is that bunq flags suspicious payments through Safety Shield, inside the app. If a transaction needs your attention, you'll see it there, not in an email asking you to log in through a link.

The "pending refund" email

Subject: Your refund of €89.00 is ready to claim
From: refunds@bunq-payments.eu

Unexpected good news is just as effective a hook as unexpected bad news. Confirm your bank details to claim the refund. Except the refund doesn't exist, and your account details are what they're actually after.

No bank sends refunds through an unsolicited link. If you're genuinely owed money, it shows up in your transaction history.

The "update your details" email

Subject: Important: please update your information to avoid disruption
From: accounts@secure-bunq.com

This one tends to land around real events like account migrations, terms of service updates, or app changes, to feel timely. It asks you to re-enter your name, address, date of birth, and card number.

bunq updates your information through the app, never through email links.

Beyond email: other common phishing situations

SMS 

The same templates, sent by text. Often with a shortened URL that hides where the link actually goes. Fraudsters can also spoof sender names so the message appears in the same thread as real bunq notifications.

Phone calls

This is the one that catches the most people. Someone calls claiming to be from bunq's fraud team. They might already know your name and the last four digits of your card, pulled from an earlier data breach. They sound calm, professional, and genuinely concerned.

The script is always a version of the same story: your account is under attack, you need to move your money to a safe account, you need to act before it's too late.

If you hear this, hang up. bunq never asks you to move money to a "safe account," and once funds are transferred, they're almost impossible to recover.

bunq will never call you. Before you transfer money anywhere, including to someone claiming to be from bunq, open the app and check the in-app chat. If there's nothing there, there's no emergency. The call wasn't from us.

Fake websites

A fraudster copies bunq's site design, registers a convincing-sounding domain, and drives traffic to it through ads or links. Whatever you type in goes straight to them.

Always check the URL before logging in anywhere. The only real address is bunq.com.

How to spot it, whatever form it takes

Whatever the format, the giveaways are the same:

• Urgency. "Act now," "within 24 hours," "your account will be closed." Any message designed to rush you is worth slowing down for.

• A link to click. Genuine banking communication won't ask you to verify something through an email link. Go to the app directly instead.

• Requests for credentials. No bank will ask for your password, security code, or card number by email, SMS, or phone.

• A slightly wrong sender address. Look at the full domain, not just the display name. bunq only sends from bunq.com or help.bunq.com.

• "Dear customer." If the message doesn't use your name, it was sent to thousands of people at once.

How to verify you're actually talking to bunq

Any genuine contact from bunq starts in the app: a push notification or in-app message. bunq won't call you out of the blue and won't email you a login link.

bunq doesn't call you, and won't ask for your password, security code, or card number outside the app. If you're ever unsure, open the app and check the in-app chat. If there's nothing there, the call or message wasn't from us.

When you send money, bunq's IBAN-Name Check also verifies that the account holder's name matches the IBAN before the payment goes through. If they don't match, you'll see a warning. If it warns you, stop.

If you receive anything claiming to be from bunq that asks for your credentials or a money transfer, report it and delete it.

If you've received something suspicious

1. Don't click anything, including the unsubscribe link.

2. Don't reply.

3. Open bunq from the app directly, not from any link in the message.

4. Report it to bunq. It helps the team take down fake sites faster.

If you've already clicked or shared something

Change your security code in the app straight away. This logs out every device connected to your account, including whoever got in. Then follow the anti-fraud guide and file a fraud report. The sooner you flag it, the greater the chance of getting your money back.

If you need to talk to someone, the SOS Hotline is available directly through the app. Zero wait time, day or night. When your case needs a specialist, it's typically resolved within hours.

If it does happen, you're not dealing with it alone. bunq's team will be with you at every step, from the moment you flag it through to resolution.