Why this matters
Phishing is the most common scam in the world, and almost every other fraud starts with it. The idea is simple: a fraudster sends a message that looks like it's from a company you trust, to trick you into handing over your login details, card data, or verification codes — or into clicking a link that installs something harmful.
Phishing works because the messages look real and arrive at believable moments. Once you understand how it's built, it becomes much easier to spot.
How phishing works
A phishing attack usually has four steps:
The bait. You receive a message that appears to be from a trusted brand — your bank, a payment service, a delivery company, or us.
The hook. The message gives you a reason to act fast: a blocked account, a suspicious payment, a package on hold, a refund waiting.
The link. You're pushed to click a link that leads to a fake website designed to look like the real one.
The catch. On the fake site, you enter your login, card, or personal details — and hand them straight to the fraudster.
The main forms of phishing
Email phishing — a fake email imitating a real company, usually with a link or attachment.
Smishing — the same idea by SMS or messaging apps. → See: Smishing & Vishing: SMS and Phone Call Scams
Fake websites — a copycat site with a slightly different address, often reached through a phishing link.
Spear phishing — a targeted version using your name and real details to seem more convincing.
How to spot a phishing message
Check the sender's address carefully. Fraudsters use lookalike addresses with small changes (extra letters, different domains). Our genuine emails come only from support@blackcat.app (or occasionally support2@blackcatcard.com for some long-standing customers).
Don't trust the link text. The visible text can differ from the real destination. Hover on desktop or long-press on mobile to preview the actual URL before tapping.
Watch for urgency and threats. "Act now or your account will be closed" is a classic phishing trigger.
Beware generic greetings. "Dear Customer" instead of your name can be a sign — though scammers increasingly personalise messages, so this alone isn't proof.
Be cautious with attachments. Unexpected attachments can contain malware.
Remember what we'll never ask. We will never ask for your password or full verification code by email or message.
What phishing looks like in real life
"We've detected unusual activity on your account. Verify your identity now to avoid suspension: [link]."
"Your payment could not be processed. Update your card details here: [link]."
"You have a pending refund of €59.90. Confirm your bank details to receive it: [link]."
An email that looks exactly like ours, with our logo, asking you to "reactivate" your account.
The design can be perfect — judge the message by what it asks you to do, not by how it looks.
How to protect yourself
Never log in through a link in a message. Open the app or type the official website address yourself.
Verify independently. If a message claims to be from us, check with us before acting.
Keep two-factor authentication on, so a stolen password alone isn't enough.
Not sure? Send us a screenshot in the 24/7 support chat inside the Blackcat or Blackcatcard app, and our agents will confirm whether the message is genuine.
What to do if you clicked or entered your details
Change your password immediately if you entered it, and enable two-factor authentication.
If you shared card details, contact us right away through the in-app chat so we can secure your account.
Don't open any further links or attachments from the message.
Report it so we can protect other users.
→ See: I Think I've Been Scammed: Immediate Steps