Scam emails and texts: how to spot one and what to do

A scam message is an email or text that looks like it comes from your bank, PostNord, the Swedish Tax Agency, Kivra or a company you recognise, but was sent by criminals. The goal is always the same: to get you to click, to log in with BankID, or to hand over your card details. The safest answer is always to not click, and to go to the company's real app or website yourself instead.

One rule that holds without exception: nobody legitimate ever asks for your password, your BankID code, a verification code or your card number. Your bank, the Tax Agency, Kivra, the police and Solvora never do, not by phone, text or email. Never approve a BankID signing that you did not just start yourself.

How to recognise a scam message

1. It is urgent. Your account closes today, the parcel is returned in six hours, pay within the hour. Real senders give you time.
2. You are asked to identify yourself with BankID through a link in the message.
3. The sender address looks nearly right but not quite. Press and hold the sender name, or click it, to see the full address.
4. An amount, a parcel or an invoice you do not recognise.
5. A greeting that does not fit you, or language that is almost but not quite right.
6. The message sits in the same text thread as genuine messages from the company. Criminals can arrange that, so it is no proof the message is real.

Try this first

1. Do not click the link, do not open attachments, and do not reply.
2. Do not open BankID because a message or a caller tells you to. That is the single clearest sign of a scam there is.
3. If you want to check whether the matter is real, open the company's app yourself, or type their address into the browser by hand, and log in there. Only call numbers you found on their official site, never the number in the message.
4. Report the email as phishing. In Gmail: open it, tap the three dots at the top right and choose Report phishing. In Outlook: choose Junk and then Phishing.
5. For a text, tap the sender's name and choose to report or block the number. Phones word it differently, but the option is under the sender's name.
6. Delete the message.

If you have already clicked

1. If you only opened the page without typing anything: close the page and restart the device. The risk is then small.
2. If you entered a password: change it immediately on the real site, and change it on every other service where you used the same one. Start with your email, because it controls password resets everywhere else.
3. If you used BankID or gave card details: call your bank immediately and block the card and account. Banks answer around the clock for blocking, and the number is on the back of your card and on their website.
4. If you installed an app the message asked for, delete it and restart the device. Call the bank in this case too, because such apps are usually built to read what you type.
5. If you have lost money, report it to the police on 114 14. Do it the same day.

If you are unsure whether a message is genuine, show it to us in the chat before you do anything with it. If money is involved, call the bank first and us second. The order matters.