Key takeaways
- Phishing is a scam where someone pretends to be a trusted party, such as a bank, Skatturinn or a crypto exchange, to get hold of your login details or money.
- It arrives by email, text message, ads, fake support accounts on social media and phone calls, and often leads to a website that looks just like the real one.
- Read the domain carefully, don't click links in unexpected messages, and never approve an e-ID login you didn't start yourself.
- A legitimate service will never ask for your password, seed phrase, e-ID PIN or card details in a message.
Contents
PhishingPhishingA scam where criminals pretend to be a trusted company or authority to get you to hand over passwords, card details or your seed phrase. is a scam where someone pretends to be a trusted party, such as your bank, Skatturinn (the Icelandic tax authority) or a crypto exchangeCrypto exchangeA company or platform where you buy, sell and swap crypto, for example with krónur., to get you to hand over a password or card details, or to approve a login. It usually starts with a message containing a link to a fake website that looks exactly like the real one.
The name comes from fishing: the scammer casts bait to thousands of people and waits for someone to bite.
How does phishing work?
Imagine someone in a fake uniform knocking on your door and saying they need your house key to fix a leak. The uniform looks genuine, but the person wearing it isn't. Phishing is the digital version of that.
It usually follows the same pattern:
- You get a message that seems to come from someone you trust.
- The message gives you a reason to hurry: an unpaid bill, a locked account, a suspicious login or a parcel waiting.
- A link takes you to a fake page, or you are told to call a particular number.
- You type in your details or approve a request, and the scammer uses them instantly.
Phishing is a form of social engineering. It relies on trust and time pressure, not on sophisticated technology.
The main types of phishing
The classic route. The email copies the company's logo, fonts and wording. The sender's name can be anything, so "Skatturinn" in the sender field proves nothing.
Text messages
Short texts about a parcel, a fine or a bill, with a link to pay. On a phone it is harder to see where a link leads, and scammers take advantage of that.
Fake websites and ads
Scammers sometimes buy ads that appear at the top of search results when you search for a bank or crypto service. The ad leads to a fake login page. The same goes for websites that imitate well-known crypto walletsCrypto walletAn app or device that holds the keys to your crypto and lets you receive, store and send it..
Fake support accounts
If you complain publicly on social media about a problem with a wallet or crypto service, the reply may come from an account pretending to be customer support. It wants to move the conversation to private messages, where it asks for your seed phrase or password.
Phone calls
Scammers can fake the number they call from so it looks Icelandic. According to Auðkenni, the caller usually speaks English, though. The aim is often to get you to approve a login with your e-ID (rafræn skilríki) or to install a program that gives the scammer access to your device.
Examples from Iceland
- Skatturinn, November 2025. The police warned about emails in the name of Skatturinn about an unpaid bill that had to be paid the same day. The link displayed
www.island.is/greida, but it actually led to a site run by the scammers, which asked for the person's kennitala, phone number and card details. - The traffic police, June 2026. Text messages in the name of the traffic police reached large numbers of Icelandic phones, with a link to pay a fine. The police said they had never received so many reports of attempted cybercrime in such a short time. Real police fines always arrive through island.is.
- Calls from "the bank", November 2023. CERT-IS, Iceland's national cybersecurity team, warned about calls from numbers that looked like those of Icelandic banks and payment companies. People were talked into approving an online banking login with their e-ID, and an attempt to charge their credit card followed almost immediately.
- E-ID requests, June 2025. The police received reports of people being asked to approve their e-ID when they weren't logging in to anything. The police reminded everyone that you never need to approve your e-ID to receive a payment.
How to check a link and a domain
Read the domain from the end
A domain is the name of a website, such as myntkaup.is. In a link, the domain is everything between https:// and the next slash. What matters is the last part, for example myntkaup.is. Everything to the left of it can be anything the domain's owner chooses.
| Address | Who owns it? |
|---|---|
hjalp.myntkaup.is | myntkaup.is (Myntkaup's help centre) |
myntkaup.is.innskraning-adstod.com | innskraning-adstod.com, not Myntkaup |
myntkaup-is.com | a different domain, not myntkaup.is |
rnyntkaup.is | a different domain: "rn" looks like "m" |
The same applies to banks and public bodies. Skatturinn's official website is skatturinn.is, and Auðkenni only uses domains ending in .is. The police note that phishing sites often use domains ending in .app, .top or .xyz, but .is can't be ruled out.
The link text isn't the address
The Skatturinn example shows this well: the text said island.is, but the link went somewhere else. On a computer, you can see the real address by hovering the mouse over the link without clicking. On a phone, press and hold the link to see it.
The padlock doesn't tell the whole story
The padlock and "https" in your browser only mean the connection is encrypted. Scam sites have a padlock too. It says nothing about who owns the site.
The best rule: don't click
Auðkenni advises against clicking links in emails or text messages, especially unexpected ones. Type the address into your browser or use the app. That is safer than trusting a link.
What a legitimate service will never ask for
The Icelandic police say that legitimate companies, banks and public bodies never ask for PINs, card details or passwords by message or phone. No trustworthy service will ask you for these either:
- Your seed phrase or private key. Whoever has your seed phraseSeed phraseA list of 12 or 24 words that backs up every key in your wallet, so whoever has the words can restore the wallet and take the crypto. or private keyPrivate keyA secret number that proves you own the crypto in your wallet. Whoever holds the private key controls the crypto. controls your crypto. Nobody else should ever see them. Read more in Private keys and recovery phrases.
- Your e-ID PIN. "Only you may know your PINs," says Auðkenni.
- Approving a login you didn't start. Auðkenni never requests authentication or a signature unless you initiated it.
- Remote access to your device. Programs such as AnyDesk give someone else control of your computer.
- Moving your crypto to a "safe wallet". It is always the scammer's wallet.
At Myntkaup, every withdrawal is confirmed with your PIN in the app and by email. If you get a request to confirm a withdrawal you don't recognise, don't confirm it, and contact Myntkaup straight away at myntkaup@myntkaup.is.
What to do if you've taken the bait
Act fast. The first few minutes matter.
- Gave away a password? Change it straight away, and everywhere else you used the same password. Start with your email and turn on two-factor authenticationTwo-factor authentication (2FA)A login that needs two different proofs of who you are, such as a password and a code from an app, so a stolen password isn't enough..
- Gave away card details? Contact your bank immediately.
- Approved an e-ID request or gave away a PIN? Contact your bank immediately. If someone might know your PIN, Auðkenni advises revoking your e-ID on its My Pages (Mínar síður) service.
- Gave away a seed phrase? Move whatever is left to a new wallet with a new seed phrase straight away. The old wallet is no longer safe.
- Let someone into your computer? Disconnect it from the internet and get help from a computer repair service or CERT-IS.
- Report it. You report fraud and attempted fraud to the police through Ísland.is. Also tell the company the scammers were pretending to be.
There is more on securing your accounts in How to protect your crypto account.
Frequently asked questions
Is it dangerous to open a phishing email?
Usually not, if you do nothing else. The danger lies in clicking links, opening attachments or typing in information. Be especially careful with attachments you weren't expecting.
Can scammers fake a phone number or email address?
Yes. The police point out that scammers can fake a phone number so it looks Icelandic. The sender name on an email can also be anything. So don't rely on it alone.
I clicked a link but didn't enter anything. What now?
Close the page and don't open anything that may have downloaded. Make sure your operating system and apps are up to date, and keep an eye on your accounts for the next few days. You can also report the attempt to the police.
How do I recognise phishing in the crypto world?
Be wary of messages about "verifying your wallet", surprise airdropsAirdropWhen a project sends free tokens straight to people's wallets, often to promote itself, though fake airdrops are also a common scam. or updates that require your seed phrase. Read about common crypto scams.
Closing thoughts
Phishing works because it looks genuine and arrives when you least expect it. You don't need to know every trick to protect yourself. A few habits are enough.
Don't click links in unexpected messages, read the domain, and never approve an e-ID request unless you started the login. If in doubt, stop and get in touch through a channel you know.
