Why this matters to you

A real story from our own clients.

A company director clicked a fake link and typed in his email login. For two weeks the attackers quietly read everything coming in and going out — working out who he talks to, how he writes and who in the company pays the invoices.

Then one day the accountant got an email from the director’s genuine mailbox: pay €100,000 against a pro-forma invoice. Correct Lithuanian, his writing style copied perfectly.

The accountant had a bad feeling and asked the director whether he’d really sent it. That’s the only reason the hijacked mailbox came to light — and a big loss was avoided.

It all started with one link. Not a genius hacker — an email that looked normal. In this lesson: how to recognise one, plus two more schemes that are working in Lithuania right now.

Sign #1 — manufactured urgency

“Within 24 hours”, “immediately”, “final warning”. The scammer wants you to act faster than you think. Real institutions (your bank, VMI — the Lithuanian tax authority — or Microsoft) never demand action “right now or lose everything”.

Sign #2 — the sender’s address

The name can say “Swedbank”, while the address is info@swedbank-security.xyz. Always look at the actual email address, not the display name. On a phone, tap the sender’s name to see the address.

Sign #3 — links

Hover the mouse over a link without clicking — the real address appears at the bottom of the screen. On a phone, press and hold the link until the preview appears.

But you also have to be able to read the address. Scammers put familiar words in it, hoping you’ll only read the beginning.

How to read a link in 3 seconds

https://unipark.lwbtmfo.club/com

lwbtmfo.club — the real owner. The two words before the first “/”.

unipark. — a prefix. The owner can add anything: unipark, swedbank, microsoft.

/com — decoration after the slash, so your eye sees “.com”.

https://unipark.lt/✓ genuine
https://microsoft-login.helpdesk-lt.com/✗ not Microsoft

Rule: find the first “/” after https://. The two words before it are the real owner. Everything else can be a lie.

Works on phone and computer alike — only the way you see the address differs. (Unipark is a Lithuanian parking operator; its real site is unipark.lt.)

Sign #4 — the unexpected attachment

An invoice you weren’t expecting. A “scanned document” from an unknown scanner. A ZIP file called “CV”. If you weren’t expecting the attachment, don’t open it until you’ve checked with the sender through another channel.

A real case from our clients: an email with a .zip file attached. Inside, a PDF with a “payment link”. Clicking the link opened an infected website. The ESET web filter stopped it.

Matryoshka: why so many layers

  1. 📧 Email“please pay”
  2. 🗜 .zipharder for the mail filter to look inside
  3. 📄 PDFlooks like an ordinary invoice
  4. 🔗 Linkonly here can you see where it leads
  5. 🛡 FilterESET stopped the infected site
Each layer hides the link from the filters — and each one is another place where you could have stopped.

This time the software saved the day. But a web filter is the last safety net, not a plan: a brand-new page may not be on its lists yet.

Today a common dangerous attachment isn’t even a virus — it’s an HTML file. You open the “scanned document” and a Microsoft login window opens in your browser. It looks genuine, but the address bar shows not microsoft.com but a file path on your own computer, e.g. file:///C:/Users/.../Downloads/...

You opened an attachment and a login window appeared in your browser — it’s fake. Real login pages live at a real address, not in a file on your computer.

Sign #5 — the “boss” request

CEO fraud: an email supposedly from your manager, urgently asking you to transfer money or buy gift cards. Always check with a phone call to a number you know. No real boss will be angry about a check — they’ll be angry about lost money.

“2FA didn’t work” — it’s not a glitch

One of our clients got a notice that unread emails were waiting in his Microsoft 365 account. He clicked, entered his password, entered his 2FA code — and “something went wrong”.

It didn’t go wrong by accident. The fake page passed his password and code to the real Microsoft in real time, took the login session and let the scammer in. The director saw an “error” — the scammer saw his mailbox.

This is called AiTM (adversary-in-the-middle) — the scammer sits between you and the real site:

What happens in those few seconds

💻Youenter your details
password 2FA code “error”
🎭Fake pageSigitas the scammer
same password same code session 🍪
☁️Real Microsoftsees correct details

Sigitas is already in your mailbox. You see an “error”.

  1. You enter your password on a page that looks like Microsoft.
  2. In the same second, the fake page enters it on the real Microsoft.
  3. Microsoft asks for a 2FA code — you enter it on the same fake page.
  4. The code travels the same way. Microsoft sees the correct password and the correct code.
  5. Microsoft hands over the login session — not to you, but to the fake page.
  6. You're shown “something went wrong”.
  7. The scammer browses your mailbox. MFA worked — just not for you.
A passkey or hardware key breaks this chain: they only work on the real Microsoft address, so the fake page has nothing to pass on. (Sigitas the scammer is our recurring villain — Sigitas is a common Lithuanian first name.)

Two takeaways:

  1. MFA with a code isn’t bulletproof. Only passkeys or hardware keys resist this attack — there’s no code to pass on.
  2. After an incident like this, changing the password isn’t enough. Tell IT so they revoke active sessions and check the mailbox rules and sign-in methods — attackers often start by setting up silent email forwarding or adding their own phone as a second MFA method.

A hijacked mailbox is exactly how the story at the start of this lesson began. How to protect the company’s money even when the mailbox is already hijacked is covered in a separate lesson, Invoice fraud: when the email is genuine. It also has the case where a company did lose the money.

Not just email — SMS too

A real message received in August 2026. It’s in Lithuanian, exactly as sent — read the explanation underneath and look for three things:

← +212 7 74 08 63 05 1
Unipark – Nesumokėto stovėjimo mokesčio pranešimas

Mūsų sistemos duomenimis, su Jūsų transporto priemone susijęs stovėjimo mokestis iki šiol nėra gautas. Siekiant išvengti papildomų mokesčių ir galimų administracinių apribojimų, prašome kuo greičiau atlikti mokėjimą.

Norėdami peržiūrėti savo stovėjimo sesijos informaciją, apsilankykite mūsų oficialioje svetainėje ir įveskite savo transporto priemonės valstybinį registracijos numerį.

https://unipark.lwbtmfo.club/com 2

(Tiesiog atsakykite „T“, tada uždarykite SMS žinutę ir atidarykite ją iš naujo, kad suaktyvintumėte nuorodą. 3 Jei nuoroda vis tiek neveikia, nukopijuokite ją ir įklijuokite tiesiai į „Safari“ naršyklę.)

Siekdami išvengti tolesnio administracinio nagrinėjimo, maloniai prašome kuo greičiau atlikti mokėjimą.

Klientų aptarnavimo skyrius

A real scam SMS, quoted exactly. In English: “Unipark — notice of an unpaid parking fee. Pay as soon as possible to avoid extra charges… (Simply reply “T”, then close the SMS and open it again to activate the link. If it still doesn't work, copy it into Safari.)”
  1. 1 A Moroccan number (+212). A Lithuanian parking company doesn't text from Africa.
  2. 2 A fake address. The real one is unipark.lt. This one is lwbtmfo.club, and the “/com” at the end is only there to fool your eye.
  3. 3 The cleverest part. iPhones disable links from unknown senders. Sigitas the scammer is asking you to switch off your phone's protection yourself. No real company ever sends that sentence.

When the fake looks perfect

This email landed in our own mailbox. At first glance, a tidy notice from Paysera (a Lithuanian payment company) about an AML/KYC check:

Outlook2026-08-04 09:12
ΑΜL/ΚΥС геіkаlаvіmаі – раtvігtіnkіtе tараtуbę 1
Ρ Ρауѕега Сһесk
siska@gmmobil.com 2
To: antanas@itbroliai.lt
Gerbiamas kliente,

vykdydami pinigų plovimo prevencijos reikalavimus, privalome pakartotinai patvirtinti Jūsų tapatybę. Pagal sutarties 2.13 punktą 3 nepatvirtinus per 10 darbo dienų, paslaugos gali būti apribotos.

Patvirtinti tapatybę: һttрѕ://www.рауѕега.соm/lt/раtvігtіntі 4

Užklausos Nr.: KEB-147-PROT0 5

UAB „Paysera LT“, Pilaitės pr. 16, Vilnius · +370 5 2071 558

🖱 Hovering reveals the real link:
google.com/share.google?q=7PZFAudJ2yA73JkEn

Five techniques in one email, quoted exactly. In English — subject: “AML/KYC requirements – confirm your identity”; body: “Dear customer, under anti-money-laundering requirements we must re-confirm your identity. Under clause 2.13 of the agreement, if you don't confirm within 10 working days, services may be restricted. Confirm identity: … Request no.: KEB-147-__PROT0__”.
  1. 1 Letters that aren't letters. The whole subject line is written in Greek and Cyrillic characters that look identical. Filters see gibberish; you see “AML”.
  2. 2 The address doesn't match the name. “Paysera Check” is writing from gmmobil.com.
  3. 3 Invented legal authority. The contract clause doesn't exist — but it sounds serious.
  4. 4 Text ≠ link. The visible address says paysera.com, but it actually goes through a Google redirect.
  5. 5 And here they slipped up: __PROT0__ — an unfilled template variable. Automation always gives itself away somewhere. Read the small print.

The first sign is worth a closer look. This is what the sender’s name is really made of:

X-ray: “Paysera” from the email

ΡGreekU+03A1 аCyrillicU+0430 уCyrillicU+0443 ѕCyrillicU+0455 еCyrillicU+0435 гCyrillicU+0433 аCyrillicU+0430

0 Latin letters out of 7. To you it's “Paysera”. To a computer, a completely different word.

The letter “г” is the Cyrillic “g” — in lowercase it looks like an “r”. The whole subject line is written the same way.

A second SMS scheme: customs fees and your card

Same mechanics, different bait — and a different prize.

← Lietuvos paštas
Jūsų siunta iš AliExpress sulaikyta muitinėje.

Norėdami gauti siuntą, sumokėkite muito mokestį 1,50 EUR:

https://post-lt-muitas.info/pay

A retold scheme, in Lithuanian as it arrives. In English: “Your parcel from AliExpress is held at customs. To receive it, pay a customs fee of 1.50 EUR:” — supposedly from Lietuvos paštas (Lithuanian Post). The page looks almost like post.lt.

The page that opens looks very like the real one. It asks for your card details. Enter them and €1–2 is charged, with a message that everything went through.

Congratulations: your card details have been stolen.

Why the small amount is the cleverest part

The €1.50 isn’t what the scammer is after. It’s a card check — making sure the card works and the details are correct. The real losses come later, or the details are sold on.

The amount is chosen deliberately: nobody calls the bank over one euro fifty. Silence is exactly what they need.

Two rules:

  1. A customs fee is never paid by typing card details into a link from an SMS. The real post office charges fees through its own website or app, once you’ve logged in.
  2. Entered your card details → block the card now, in your banking app, without waiting until morning. It takes seconds and can be undone.

The scheme works because almost everyone orders something from AliExpress or Temu — the message lands on a real expectation. Before holidays these messages peak.

The fix: virtual cards with limits

It’s hard to protect yourself from the messages — they’ll keep coming. But you can make stolen card details almost worthless.

What that message cost

The same Unipark scheme, a real case. A company owner clicked the link, confirmed a Smart-ID request, and saw on screen that everything was fine. Some time later he noticed a five-figure sum had gone from the current account.

He didn’t type a single password for the scammers. He just confirmed.

A Smart-ID confirmation is a signature

This is the most important part of the lesson.

Smart-ID (the app most people in Lithuania use to log in to their bank and sign documents) always shows who is asking for confirmation and what for. The scam page connects to your bank at the same moment — so a genuine bank request appears on your phone. You’re thinking about a parking fee, while you’re confirming a login to your bank.

What you are really confirming

📱Youthinking about parking
licence plate personal ID code “Paid ✓”
🎭Fake “Unipark”Sigitas the scammer
logs in as you account access
🏦Your banksees a genuine Smart-ID

🏦 → 📱 The bank sends a genuine Smart-ID request to your phone

You confirm — thinking you're paying for parking

  1. An SMS link takes you to a page that looks like Unipark. You enter your licence plate.
  2. The page asks for your personal ID code (asmens kodas) “for identification”.
  3. In the same second, the page logs in to your bank with your ID code.
  4. The bank sends a genuine Smart-ID request — to your phone.
  5. You confirm. The verification code matches — because the page copied it from the bank.
  6. The bank lets in — not you, but the scammer.
  7. You're shown “Paid ✓”. You relax. The scammer is in your bank.
The page is fake. The Smart-ID request is genuine. That's exactly why it looks trustworthy.

The “everything’s fine” message afterwards comes from the fake page, not the bank.

The only moment the scam is visible is on your phone screen:

What you think you're doingParking feeon the “Unipark” page
≠
What Smart-ID showsYour bankLogin

They don't match → reject. Not later — that second.

Four rules:

  1. Read who is asking and what for. Not “confirm”, but who and what you’re confirming. Expected Unipark, but Smart-ID shows your bank? Stop.
  2. A matching verification code proves nothing. The fake page simply copies it from the real bank — during an attack the codes will match.
  3. Expected one thing, asked for another (expected parking, asked for a bank login) → stop. Not later — that second.
  4. Go to your bank only from its own app or by typing the address yourself. Never from an SMS.

By the way, the story doesn’t say why the daily and monthly limits didn’t kick in. So take the hint — check your own limits today. For most people they’re set far higher than they actually need.

Not sure? Ask AI

You don’t have to decide alone. AI is very good at spotting exactly what the human eye misses: fake letters, mismatched domains, pressure wording.

At the top of the lesson there’s a “Learn with AI” button — it copies the whole lesson together with instructions. Paste it into an AI and add your suspicious email right there.

What to do with a suspicious email

  1. Don’t click links or open attachments.
  2. Report it to your IT team — or to us: pagalba@itbroliai.lt (forward the email as an attachment so the headers are kept). If it’s urgent, call +370 618 05093.
  3. Delete the email.
  4. If you’ve already clicked — tell IT, but you don’t need to change your password yet: clicking a link alone doesn’t reveal it. Change your password only if you typed it into the fake page — whether or not the login seemed to work. Then change it straight away, everywhere you used the same password, and turn on MFA.

Reporting is never embarrassing. Staying quiet is.

Check yourself

Ten questions on what you’ve just read. At the end you’ll get a certificate with your score — you can add it to your LinkedIn profile.