Scammers in the bank's name: fake Swedbank, SEB and Luminor websites, calls and Smart-ID requests
On this page · 7
Most money is lost not when a person transfers it to a scammer themselves, but when they enter their login details on a website that looks like their bank's. In the police daily incident reports such cases recur every day: “tried to log in to a possibly fictitious bank website”.
This article covers three ways scammers hide behind a bank's name, what the banks themselves publish about what they never ask for, and what to do if you have already entered your details.
In short
- A bank never asks you by phone, email or message to say or enter PIN codes, login details or a card number.
- Log in to your bank only through the app or by typing in the address yourself – not through a search result, an advert or a link sent to you.
- A Smart-ID request that you did not initiate means someone is logging in under your name. Do not enter the PIN.
Real cases from the police reports
- Alytus, October 2026. A woman (born in 1974), while trying to log in to a possibly fictitious bank website and having entered her login details, lost 9 999 €.
- Klaipėda district, September 2026. A woman born in 1953 lost 2 999 € in the same way.
- Klaipėda, September 2026. A man born in 1960 lost 2 892 €.
- Tauragė, October 2026. A woman (born in 1977) selected a Regitra page in a search, tried to log in through online banking and lost 1 100 €.
The last case shows that it is not only a “bank” website that can be fake. Any website that offers to “log in through your bank” may have been created to intercept your bank details.
Three ways of posing as a bank
1. A fake website
Luminor describes the scheme like this: scammers create a fake website that looks the same as that of a real bank or the tax inspectorate, and lure people to it with emails, SMS messages, social network notifications or through search engines. Once login details and PIN codes are entered, they end up with the scammers.
The bank also stresses: when announcing changes to its services, for example an updated online bank, it never sends links to the online bank and does not ask you to log in and enter confidential information.
2. A call “from the bank”
Swedbank describes such a scenario on its security page: it looks as if the bank has got in touch, the reason is something urgent related to the account: an incorrect transfer needs to be blocked, unlawful actions prevented, details confirmed. During the call you are asked for your user ID, personal identification number, card numbers or PIN codes, and after a while a request to enter passwords appears on your phone.
The bank draws attention to the key point: the scammer wants you to confirm the payment yourself – then the transaction amount is much harder to recover.
3. An unexpected Smart-ID request
Swedbank states: if the window for entering Smart-ID or mobile signature codes came up on your phone when you yourself are not logging in to the bank, not confirming a payment, not concluding a contract and not paying by card online, do not enter the PIN codes under any circumstances.
SEB reminds us what the codes are for: PIN1 – to log in, PIN2 – to confirm transactions and documents, including payments and contracts. So a request to “enter PIN2 once more” always means you are confirming something.
What banks never ask for
| Bank | What it publishes itself |
|---|---|
| Swedbank | If it is not you calling the bank but the bank calling you – it will never ask for your user ID, card information or PIN codes. Emails from the bank are sent from addresses ending in @swedbank.lt. Before entering details, make sure the website's domain is swedbank.lt |
| SEB | When calling, employees never ask you to act quickly, to state an account or card number, online banking, Smart-ID or Mobile-ID codes or to download software, and they do not get in touch via WhatsApp, Viber or similar apps |
| Luminor | Bank employees, police officers or other lawfully operating institutions do not ask you to disclose any passwords or PIN codes |
The rule is the same for all banks: only you need the codes. An employee does not need them either to stop a payment or to “protect” an account.
How to recognise a fake bank website
- Address. The real website has the bank's exact domain. One letter more, a hyphen or a different ending – it is already a different website.
- How you got there. Through a link in a message, an advert or the first search result – stop. Anyone can buy an ad slot in search.
- Behaviour. Luminor lists the signs: the website opens slowly, windows and adverts pop up, buttons or menus do not work.
- Requests. A real bank does not ask for the card number and CVV code when you log in, and asks for PIN2 only when you confirm a transaction.
- Pressure to hurry. “The account will be blocked”, “suspicious activity has been detected” – this is pressure, not information.
A safe habit
Log in to your bank in only two ways: through the bank's official app, or by typing the address into the browser yourself and saving it in your bookmarks. Then it does not matter what the search shows or what a message sent you.
If you have already entered your details
- Call the bank immediately – on the number from your card or from the app. Ask them to block access and the cards.
- Submit a request to recall the payment. Luminor states that for a payment made as a result of fraud a recall request is filled in, and for a card transaction – a request to dispute it.
- Remove remote control software (AnyDesk, TeamViewer and similar) if you installed it at the caller's request.
- Report to the police via epolicija.lt or by calling 112 and pass a copy of the report to the bank.
- Keep the evidence: the website address, messages, numbers, payment data.
- Report the fake website to the National Cyber Security Centre (NKSC) by email at cert@nksc.lt.
If the bank refuses to return the funds and you disagree, the Bank of Lithuania (Lietuvos bankas, LB) handles consumer disputes with financial institutions – this is described on its page “Pakliuvau sukčiams: ką daryti?”.
Frequently asked questions
Can the bank call and ask me to confirm my identity with a code?
No. Swedbank, SEB and Luminor publish that when they call themselves they do not ask for PIN codes, login details or a card number.
I found the bank through Google and logged in. How do I know whether the website is real?
Look at the address in the browser: it must be the bank's exact domain. If in doubt, call the bank immediately and change your login methods.
A Smart-ID request popped up on my phone although I did nothing. What should I do?
Do not enter the PIN and reject the request. It means someone is trying to log in or confirm a transaction under your name. Notify the bank.
Is it possible to get the money back if I confirmed the payment myself?
It is harder. Swedbank stresses that this is exactly what scammers aim for – that you confirm the transaction yourself. Still, contact the bank immediately, and the police.
Is it safe to log in to other websites “through the bank”?
Only if you are sure the website itself is real. A fake website can show a fake bank login window.
Sources
- Swedbank. Saugios elektroninės paslaugos
https://www.swedbank.lt/private/d2d/ebanking/secureBanking?language=LIT - Swedbank. Prisijungimo priemonės
https://www.swedbank.lt/private/d2d/ebanking/authentication?language=LIT - SEB bankas. Finansinių sukčių pinklės: kaip į jas neįkliūti?
https://www.seb.lt/infobankas/finansiniu-sukciu-pinkles-kaip-i-jas-neikliuti - Luminor. Sukčiavimo prevencija
https://www.luminor.lt/lt/sukciavimo-prevencija - Lietuvos policija. Paros įvykių suvestinės
https://policija.lrv.lt/lt/ivykiu-suvestines/ - Lietuvos bankas. Pakliuvau sukčiams: ką daryti?
https://www.lb.lt/lt/pakliuvau-sukciams-ka-daryti - Nacionalinis kibernetinio saugumo centras. Pranešti apie kibernetinį incidentą
https://www.nksc.lt/pranesti.html
