Section: Technology & AI Author: V Reading Length: ~27 min Sources and further reading: 22 items Topics: cybersecurity, bank fraud, phishing, smishing, vishing, MFA SEO / Working Title: How do you recognise a fraudulent e-mail, SMS or phone call?
The question is: how do you recognise a fraudulent e-mail, SMS or phone call? It sounds simple until we notice that we are not comparing one thing. The number on the display is not an identity. Phishing is not vishing and vishing is not smishing. MFA is not a lock against coercion. An authorised payment that you confirmed yourself is no longer unauthorised. Only when these four things are separated can one read what the Police of the Czech Republic, NÚKIB, ČNB and ČBA actually measure for 2024 and 2025 — and what follows from that before the money leaves.
1. The bank, the police and the office see the same call in three statistics
Picture an afternoon at home. A familiar bank name appears on the display. The voice claims that a suspicious operation is running on the account. A message on the phone asks for confirmation. In the e-mail sits a link to “secure verification”. One does not ask for a definition of cyberspace. One wants to know whether one is speaking to the bank, or to someone impersonating the bank.
But the institutions that describe the problem do not see the same unit. The Police of the Czech Republic and the Ministry of the Interior track recorded offences in cyberspace. In 2024 there were 18,495 of them, that is 10.67% of 173,322 offences of total crime, 5.5% fewer year on year; the clearance rate was 15.4% [1][2]. In 2025 there were 21,137 of them, that is 12.4% of 170,051 offences, 2,642 more year on year, that is 14.3%; the clearance rate was 15.1% [3][4]. That is a broad police category. It is not the number of fraudulent calls.
ČSÚ and the criminal statistics for narrowly qualified cybercrime under Sections 230 to 232 of the Criminal Code show a different total: 1,224 offences in 2025, 93 fewer than the previous year, that is 7.1% [5]. NÚKIB, for its part, records cyber incidents under its statutory and working framework. In 2024 there were 268 of them, of which 1 was very significant and 18 significant [6]. For 2025 the Ministry of the Interior reports 203 incidents cited from NÚKIB [4]. The Czech Banking Association speaks of clients of member banks, their losses and attacks [12][13].
At first glance this is one threat. In fact each is adding a different object. The police see offences. ČSÚ a narrow legal category. NÚKIB incidents at regulated and surveyed organisations. ČBA bank clients. ČNB a legal regime and complaints. That is why they can all be partly right and a shared figure for “how many fraudulent calls there were” still cannot be honestly assembled.
A familiar number on the display is not an identity.
— Jiný Kontext
2. One request for an action has at least five layers
A scam does not begin with the loss. It begins with the channel. An e-mail has a header, a link and an attachment. An SMS or RCS has a short message, a sender name and often pressure for speed. A call has a voice, an intonation and the ability to raise immediate fear. A messenger adds the appearance of a personal relationship. Each channel carries different traces and a different rhythm of decision.
The second layer is the sender’s mask. It may be a bank name in an SMS, a similar domain in an e-mail or a spoofed calling number. The mask lowers resistance. It does not prove identity. That is the first practical rule: identity does not begin with what the display shows. It begins with whether verification runs through a channel that you chose and that you know in advance.
The third layer is the script. Some legends rest on fear: the account is under attack, the police are investigating, someone has misused an identity card. Others rest on greed: an investment, a quick return, a missed opportunity. Still others rest on trust: a colleague, family, a familiar voice. Time pressure is not evidence of authenticity. It is part of the script.
The fourth layer is the requested action. Fill in a datum. Dictate a code. Confirm MFA. Send money. Install remote access. This is precisely where a suspicious message becomes a loss. The fifth layer is the remedy: the bank, the Police of the Czech Republic, the financial arbitrator or a court, according to what happened and which legal regime applies. None of these layers is an instant refund.
This construction matters, because the defence must not guess how convincing the mask is. It must stop the action. If a call asks for a code, the problem is not only the voice. If an SMS asks for a click, the problem is not only the text. If an e-mail asks for a login through a link, the problem is not only the logo. We always ask what action the channel wants from us and whether we verify it elsewhere.
3. The number on the display is not an identity
People tend to believe what looks familiar. A bank name in a message, a helpline number on the display, the name of an office in an e-mail. But ČNB and NÚKIB both warn about fraudulent calls and spoofing, that is situations in which a fraudster tries to look like a known institution [7][9][11]. It does not follow that every familiar number is spoofed. It follows that a familiar number does not, by itself, verify identity.
Technical systems for verifying a calling number solve only part of the problem. The American STIR/SHAKEN framework, which the FCC writes about, works with authentication of a telephone number on the network and with operators’ relationship to the number [18]. That is a useful layer. It is not proof of who exactly is speaking, why they are calling and whether they have the right to demand your action. The success of similar verification on Czech networks is not, on the dossier, publicly reported as a map against which every call could be judged.
Looking a number up on the internet is not enough. If the mask shows a bank number, the internet will only confirm that the number really belongs to the bank. It will not prove that the bank is calling from it just now. The right step is different: hang up, do not call back the number on the display, and use an official contact from the institution’s website, from the payment card or from the app. Where a bank offers call verification in the app, that is a better check than a voice on the phone.
Identity is therefore not what arrives at you. Identity is what you verify. That is a small shift, but it changes the whole decision.
4. Phishing is not vishing. Vishing is not smishing
The word phishing is often used for everything. For e-mail, SMS and a phone call. In a headline that helps. In a defence it harms. E-mail phishing leaves different traces than smishing in SMS and vishing in a voice call. ČNB distinguishes the channels in its overview [9][10]. The point is simple: the same goal, a different channel, a different test.
With e-mail one can deal with the address, the domain, the header, the attachment and the link. With SMS there is little space and a greater role falls to the sender name, the urgency and the link. With a call the pressure acts in real time. One does not have time to read in peace. That is why hanging up matters so much on a call. Not because the call is always a scam. Because the same channel that raised the pressure must not be the channel of verification.
In the Threat Landscape 2025 report ENISA works with a European dataset of 4,875 incidents for the period from 1 July 2024 to 30 June 2025. It states that 77% of incidents were of the DDoS type and that phishing appears in about 60% as an intrusion vector [17]. These figures cannot be turned into the sentence that 60% of Czech criminal statistics is phishing. They measure a different population and a different unit. They still remind us that a social entry into a system remains important even where the incident is later described in technical language.
From a practical point of view it is better to forget the label and look at the request. Does the channel want a datum? A code? A confirmation? A transfer? Remote access? If so, the defence is not to pick the right Latin word. The defence is a second channel.
5. Broad cyberspace is not narrow cybercrime
The year 2025 brought, according to the Police of the Czech Republic and the Ministry of the Interior, 21,137 recorded offences in cyberspace [3][4]. The same year, however, ČSÚ in narrowly qualified cybercrime under Sections 230 to 232 of the Criminal Code reports 1,224 offences [5]. Both figures can be right. They do not measure the same thing.
Broad cyberspace includes offences in which the digital environment plays a substantial role. They may be advertisement frauds, investment legends, phishing and other forms of social engineering. Narrowly qualified cybercrime aims at offences around unauthorised access to a system, passwords and similar conduct. If someone on the phone persuades a person into a transfer, that can look different in the statistics than an attack on a system.
The clearance rate of 15.1% in 2025 for offences in cyberspace is not the share of money returned [3][4]. It is a police indicator of the clearing of an offence. There can be a case that is cleared while the money is not back. And there can be a payment that the bank helps to stop without a rapid clearing of the whole network of offenders.
Here again it is clear why one large number is not enough. The reader does not need to know only how large the problem is in the aggregate. The reader needs to know when to stop acting in the channel that is asking for an action. Statistics show the scale. They do not decide for the reader in the minute of a call.
6. A NÚKIB incident is not a PČR offence
NÚKIB is an important institution, but its statistic is not the same as the police statistic of criminal offences. In 2024 it recorded 268 cyber incidents, which the dossier describes as a series record; of them 1 was very significant and 18 significant [6]. In a questionnaire survey of 415 respondents, of whom 324 were regulated and 91 unregulated, more than 90% of respondents encountered phishing and more than 80% fraudulent e-mails [6]. NÚKIB states that it did not verify these questionnaire data. “Encountered” is not the same as “suffered a loss”.
For 2025 the Ministry of the Interior reports 203 incidents cited from NÚKIB; the fall against 2024 was linked mainly to DDoS [4]. A direct download of the NÚKIB PDF report for 2025 did not, according to the dossier, load as of 1 September 2026. It is therefore precise to stay with what the Ministry of the Interior states, and not to add one’s own certainty.
NÚKIB also draws a boundary to its agenda in fraudulent calls to citizens [7]. That does not mean the call is not dangerous. It means that another institution is watching another piece of the problem. The Velké odhalení campaign can be a useful source of warning and education [21]. It is not a police series of offences.
Separating these things is practical. When a firm deals with an incident, it asks about systems, duties and reporting. When a household deals with a call from an alleged bank, it asks about verification of identity and stopping the action. Both belong to cybersecurity. They are not the same door.
7. MFA is not a lock against coercion
Strong authentication protects against many attacks. The Payment System Act treats it as a duty of the provider in defined situations [14]. But MFA is not a magic lock against social engineering. If an attacker induces a person to confirm the authentication themselves, the technology has done part of its job and the person has at the same time done an action they should not have done.
On 27 September 2024 ČNB warned against frauds with multi-factor authentication. It describes a situation in which the victim confirms the authentication themselves, and notes that after such a confirmation the consumer may bear the loss [8]. That is unpleasant, but for the defence it is fundamental. MFA is meant to stop unauthorised use without cooperation. It stops less well a state in which a person under pressure provides that cooperation.
It does not follow that the victim “has themselves to blame” in a moral sense. It follows that the legal and operational regime changes after confirmation. The bank, the police, ČNB, the financial arbitrator and the court will not deal only with the fact that the call sounded convincing. They will deal with what was confirmed, what information the person saw and whether there was gross negligence.
The practical sentence is short: do not confirm MFA that you did not start yourself. If someone on a call tells you to confirm an authentication in order to protect you, verify the situation through another channel. Not in the same call.
8. An authorised payment is no longer unauthorised
The word “unauthorised” sounds natural in a bank fraud. Someone robbed you, so the payment was surely not yours. But the Payment System Act distinguishes situations in which you do not authorise a payment transaction from situations in which you confirm it, even if the script was fraudulently extracted [14]. In its explanations ČNB notes that a consumer who themselves confirm the amount and the payee or another action may bear the loss as gross negligence [8][9].
That is not the same as a stolen card without the client’s cooperation. In a remote fraud the key is whether the person disclosed data, confirmed MFA, approved a transfer or otherwise helped the transaction through. That is why so many recommendations focus on the action, not on the look of the message.
It does not follow that every case is lost in advance. ČNB itself stresses the circumstances and at the same time says that it does not decide disputes about the return of money; that is for the financial arbitrator or a court according to the nature of the matter [9]. Something more practical follows: the defence must come before confirmation, not after it.
When the payment is gone, a rapid reaction remains: contact the bank, block further misuse and file a report with the Police of the Czech Republic. The bank may try to stop an outgoing payment. That is not, however, the same as a claim to an automatic refund.
9. A ČBA loss is not a PČR loss
For 2025 the Czech Banking Association, according to a press conference and citations, reports an average loss of CZK 23,462 per client of member banks who suffered a loss. There is further talk of just under 91 thousand attacks, CZK 12.2 billion saved by the banks and an attempt of more than CZK 14 billion [12][13]. These figures matter, but they have precise boundaries.
It is not a median. It is not the whole population of the Czech Republic. It is not only vishing. The definition of the unit “attack” is internal, and an official PDF of the association with a complete methodology is, according to the dossier as of the date of the research, missing. One therefore cannot calculate a simple share of victims who got money back after sending it. Nor can one add these figures to police offences and make from them one universal measure.
That does not weaken the practical message. Banks catch a large volume of attempts and the loss among those who suffer it is not small. But for the reader the mechanism is the key: a saved amount usually means an intervention before the loss is completed or in its immediate vicinity. If a person themselves confirm a transfer and time is running, the room for remedy narrows.
It is therefore more precise to say: ČBA figures show the banking part of the problem. Police figures show the criminal part of the problem. ČNB shows the legal regime. The user’s defence lies between them, in the decision not to perform the requested action in the channel that raised the pressure.
10. A SIM farm explains the mask. It does not explain your transfer
In the IOCTA 2026 report Europol describes an operation from 2025 against infrastructure that according to it included 40,000 SIM cards, a network of 7 Latvian nationals, at least 1,200 SIM boxes and numbers from more than 80 countries. On the basis of the service more than 49 million online accounts were said to have been created [16]. That is an example of industrialisation. Not an EU total of all frauds and not a count of Czech victims.
Such figures help one understand why a scam need not look amateur. Infrastructure, rented services, automation and AI-assisted impersonation lower the price of the mask. The fraudster need not be technically skilled in everything themselves. They can use services that simplify sending, account management or the imitation of an institution. A boundary is needed here, though: a description of infrastructure is not a guide to its use.
For the reader’s defence it is not most important how exactly the mask is assembled. What matters is that the mask itself proves nothing. If an attacker can look more like a bank, then appearance should decide even less. The action and the second channel should decide.
A SIM farm therefore explains why many convincing contacts can arrive from various numbers. It does not explain why a person should confirm a transfer. Between the mask and the loss there is still a step. That step must be delayed, interrupted and verified.
11. A deepfake voice is not a condition of the legend
A deepfake voice changes the boundary of trust. If someone’s voice can be imitated, hearing ceases to be a sufficient test of identity. Jiný Kontext deals with that in a separate text on a deepfake familiar voice [22]. This article does not want to repeat the same argument. For e-mail, SMS and an ordinary call it is enough to say less: most defences do not rest on recognising a voice. They rest on a second channel.
Many documented legends do not need a synthetic voice. A familiar number on the display, an urgent script and a call to action are enough. A person under pressure does not verify because they believe in artificial intelligence. They verify because they want quickly to stop the loss that the caller has just described.
That is why it is not good to teach people to listen for “oddities” in a voice as the main defence. The voice can be genuine and the request false. The voice can be unknown and the call genuine. The voice can be synthetic and technically convincing. The test is not hearing. The test is a return to a previously known channel.
A deepfake therefore belongs in the picture. But only as a further layer of the mask. Not as a necessary condition of the scam and not as a reason to change the basic rule: do not confirm an action in the channel that requested it.
12. A clearance rate is not a returned amount
The police clearance rate for offences in cyberspace was 15.4% in 2024 and 15.1% in 2025 [2][3]. These figures measure work with a criminal offence in the police statistic. They do not say how many victims got money back. They do not even say that in the remaining cases nothing happened. They say what share of offences was cleared under the rules of the given statistic.
A banking interception is another thing. ČBA reports CZK 12.2 billion saved in 2025 [12][13]. That is banking protection and a reaction to attempts. It is not a police clearance rate. ČNB is a further layer: it supervises, explains the regime, receives submissions, but does not decide a client’s dispute with a bank about the return of money [9].
These three successes must not be added together. A stopped payment, a cleared offence and a won dispute about compensation are different results. Each can occur without the others. For the reader a practical urgency follows from that, not a panic: speed after suspicion matters, but it matters still more not to reach the phase in which one only waits for a remedy.
The sentence “the police will investigate it” must not be the last defence before confirmation. The police arrive after the event. The second channel arrives before it.
13. The best defence is the one whose error you can still reverse
A defence against a fraudulent e-mail, SMS or call must not be a test of genius. A person need not recognise every mask. They must have a procedure that stops the action even when they do not recognise the mask. The following scheme therefore does not show how to assemble a scam. It shows where it should be interrupted.
| Type of failure | What it looks like | How to test | What will limit the damage |
|---|---|---|---|
| The number as identity | The display shows a bank or the police | Hang up and use a contact from the website, the card or the app | Treat spoofing as a possible mask [7][9] |
| MFA as a lock | A person confirms an authentication because “the bank is asking” | Do not confirm MFA that one did not start oneself | ČNB: after confirmation one may bear the loss [8] |
| Added-up statistics | 21,137 = phishing = ČBA loss = NÚKIB incident | Separate PČR, ČSÚ, NÚKIB, ČBA and ČNB | Do not leave different units in one sentence |
| Authorisation as a stolen card | A person waits for an automatic refund | Separate authorisation from an unauthorised transaction | The bank and the Police of the Czech Republic at once; the dispute belongs to the arbitrator or the court [9][14] |
| Hearing as proof | “I hear the director, so it is him” | A second channel | A voice is another layer, not a verification [22] |
Illustrative scheme: In the row stands the channel: e-mail, SMS, call. In the column stands the action: a datum, a code, MFA, a transfer, remote access. The sender’s mask is only a heading. The check sits in the action column and leads through a second channel.
The best defence is not the one that never doubts. It is the defence whose error can still be reversed. If you hang up on a genuine banker and call back the official line, you lose time. If you stay on a fraudulent call and confirm a transfer, you lose more.
14. A second channel will say more than a header
A second channel is not a call back to the number that has just appeared on the display. It is not a reply to the same SMS. It is not a click on a link in an e-mail and a subsequent “verification”. A second channel is a path you know before the incident: the official website of the institution, the number on the card, the banking app, an internal company contact, a personal verification outside the original message.
What needs to be tested before you confirm MFA
The first question is: did you start the authentication yourselves? If not, do not confirm it. ČNB expressly warns against frauds in which the victim is steered into confirming MFA [8]. The second question is: do you see an amount and a payee that you yourselves expect? The third question is: why is the authentication arriving just now? If the answer is supplied by the same call that triggered the authentication, that is not a verification. It is part of the pressure.
How to test the second channel
Hang up or stop answering in the same channel. Take the official contact from the institution’s website, from the payment card or from the app. With a bank that offers call verification in the app, use precisely that option. CISA recommends not clicking links in suspicious messages and verifying through trusted sources [19]. CSIRT.CZ accepts incident reports including phishing and works with URLs and e-mail headers [20]. That is a path for reporting, not for a panicked click.
The second channel must be known in advance in a firm as well. It is not enough to write to a colleague in the same thread from which the request came. It is not enough to reply to an e-mail with an urgent invoice. It is not enough to call the number in the message signature, if precisely this signature may be part of the problem. A firm needs a simple rule for payments, changes of a supplier’s account and remote access: verification runs through a contact stored in one’s own system, not through a contact supplied in the request.
This procedure is not distrust of colleagues. It is protection of colleagues from having their name become a tool of pressure. An accountant need not decide whether the style of an e-mail really matches the director. An IT technician need not recognise whether a call sounds like a supplier. It is enough that they know that a change of a payment account, a one-time code and remote access do not pass through the same channel in which they are requested.
A household needs the same principle on a smaller scale. Parents and grandparents are not helped by a long list of attack types if, at the decisive moment, they are afraid that someone is already emptying the account. What helps is a sentence that can be used without thinking: I will call back the number from the card or from the official app. If the caller presses a person not to hang up, that is itself a reason to hang up. A genuine institution can bear that a client verifies a call through their own channel.
A good second channel has one more property: it does not require improvisation. The number for the bank, the procedure for blocking a card, the contact for the accountant and the rule for changing a supplier’s account should be stored before the pressure arrives. In calm one can choose the right path. On a call one often chooses the fastest. A scam relies precisely on this swap. That is why preparing a list of contacts is not an administrative trifle. It is a security tool.
Three tests before a transfer
First test: hang up and verify through a second channel. Second test: do not confirm MFA that you did not start yourselves. Third test: after suspicion contact the bank at once for a block and the Police of the Czech Republic for a report. Do not deal with a deepfake voice by hearing. Deal with it by the channel.
An authorisation you confirmed yourself is no longer an unauthorised payment.
— Jiný Kontext
15. A thirteen-month time-limit is not a refund
The Payment System Act contains a time-limit for notifying an unauthorised payment transaction. Under Section 188(1) the payer must notify the unauthorised transaction to the provider without undue delay, at the latest within 13 months of the debiting of the amount; if the provider objects to a late notification, the court will not grant the right to a remedy [14]. That is a time-limit. It is not a promise of a return of money.
Beside it stand further provisions of the Payment System Act, including the rules of strong authentication and of remedy [14]. And beside them the Criminal Code, for example Section 209 on fraud [15]. This legal map matters for the reader mainly in that it does not lead to one automatic refund. A timely notification is a condition. Not a guarantee.
If a person confirmed a transaction under pressure or on the basis of a deception, the dispute may turn on cooperation and gross negligence. ČNB repeats that it does not itself decide a dispute about the return of money [9]. The practical procedure therefore remains twofold: contact the bank at once and file a report with the police. At the same time keep the communication, numbers, messages and time data for further resolution.
The best legal time-limit is the one you do not need to use. That is not cynicism. It is a description of the order. Before confirmation the second channel decides. After confirmation the time-limits, banking processes and disputes already decide.
16. Five to ten calls a day on the ČNB line are not an annual map of victims
In its FAQ on frauds in payment services ČNB states that on the Green Line it handles 5 to 10 complaints a day about frauds. The same overview says that in 2021 it did not record such complaints and that in 2022 there were already hundreds [9]. That is a useful signal of a change. It is not an annual total of victims and it is not a statistic of successful frauds.
The range of 5 to 10 a day is a figure from ČNB’s communication channel. It does not include those who call the bank, the police, the financial arbitrator or no one. It does not say how much loss arose, how much money returned, or how many cases overlap with the police statistic. It is not added to the 21,137 offences in cyberspace or to the average loss of CZK 23,462 among injured clients of member banks [3][12].
The figure still has a point. It shows that frauds in payment services are not a marginal query. People ask because the boundary of responsibility is not intuitive. A person has the feeling of having been robbed and at the same time hears that they confirmed the payment themselves. That is precisely the place where one needs to speak of a second channel earlier than of a complaint.
The statistic of the line is therefore not a map of victims. It is a warning sign at a counter to which people arrive late.
17. The hidden cost is an action in the same channel
A fraudulent message or call often does not win by being perfectly genuine. It wins by shortening the path between fear and action. It does not let a person leave the channel. The call continues, the SMS adds a link, the e-mail offers a button, the alleged banker dictates the next step. Everything happens in the same pipe in which the pressure arose.
The hidden cost is not only a money loss. It is also the confusion after the event. Whom to call? What is authorised? What is unauthorised? What does MFA mean? Who decides the dispute? Why do the police speak of a clearance rate and the bank of an interception? Why does NÚKIB count incidents and ČBA clients? The later we deal with these differences, the more expensive they are.
That does not mean a person must know all the statistics. It means they must have one rule stronger than the mask: I do not verify an action in the channel that asks for it. A number, a logo, a voice, urgency or even correct personal data do not suffice by themselves. A datum, a code, MFA, a transfer and remote access belong only after a second channel.
This rule is dull, and that is precisely why it works even under ordinary pressure.
The question is therefore not how to recognise a fraudulent e-mail, SMS or phone call by whether it looks like a bank. It is: which action are you willing to confirm in the same channel without a second, previously known verification? If the answer is “none”, that is not distrust of the world. It is a precise placing of the check.
Related texts in this series
- How do you find out whether your password or e-mail has leaked? — a leak in an index is not the same channel as an emergency call.
- In the folder: A deepfake of a familiar voice — a voice is no longer a seal of identity; this text takes e-mail, SMS and a call as three channels of pressure.