Tietoturvatiedote

2.11.2021 15:40

Warning: do not go to an online bank through a search engine

Criminals are phishing your online bank user identifiers through search engines (such as Google or Bing). You are directed from search engine results to a scam website mimicking the genuine op.fi service. When you go to the online bank, enter the address into the browser’s address bar by yourself or use OP's mobile apps.

Criminals have succeeded in getting scam websites mimicking the op.fi service to appear among the top search results for the purpose of phishing online bank user identifiers. User IDs and passwords entered into a scam website end up in the criminals’ possession and are used to attempt unauthorised payments.

If you suspect that your user ID has fallen into the wrong hands, deactivate your user ID by calling at 0100 0500 (personal customers) or 0100 05151 (corporate customers). When our Customer Service is not available, please call the OP Deactivation Service at +3581000555. It is available 24/7. Be sure to also call our Customer Service during service hours to report the incident.  

This is how the scam website looks like in search engine results: 

: 

The scam website may inform the visitor the following, for example:

Please remember these seven things when you do banking online 

  1. Do not go to an online bank through the link you have received or a search engine. The message directing you to the login page is scam. You may end up in a scam website through Google, Bing or another search engine too, so type the address on the browser’s address bar.  
  2. Check the address. Always ensure that you are at www.op.fi. Do not enter your identifiers into a site if you are not sure about its legitimacy. 
  3. Keep the identifiers to yourself. A bank or the authorities will never ask you to provide your user ID over the phone or by SMS or email. 
  4. Do not open attachments sent in the name of the bank. Make sure with your bank’s customer service that the attachments are genuine.  
  5. If anyone whose contact you have not expected asks you to install software in your device, do not do that. Install yourself the software you need through an app store of your device.  
  6. Do not confirm any transactions that you do not recognise or are not aware of doing at that very moment. Always read the confirmation requests with due care – if there is anything that does not match, do not confirm anything.  
  7. Please ask in the case of confusion. If the contact or message is suspicious, please contact your own bank before you do anything else.