Security and fraud prevention
Every year, thousands of people in Estonia lose millions of euros to fraudsters. Fraudsters do not choose their victims based on age or education. Instead, they use psychological pressure and create a sense of urgency to make you act before you have time to think. As a bank, we do everything we can to detect and stop suspicious transactions. However, the most effective protection starts with you.
If you suspect fraud
Acting quickly after discovering fraud can help reduce the damage.
Protect your account
Leaked PIN codes and personal data are among the main ways fraudsters gain access to your information.
Warning signs and types of fraud
Fraudsters use well-established tactics. Knowing how to recognise them can help you avoid becoming a victim.
Don't wait if you suspect fraud
The sooner you act, the better the chance of reducing the damage. Holm Bank transfers a loan or deposit amount only to your personal current account. This is why it is important to notify both Holm and your home bank immediately if you suspect fraud. You can block your Holm credit card 24/7 through our self-service or by calling +372 677 0760.
Report fraud
[email protected]
+372 675 5055
1
Block your authentication methods and contact the bank
Close your Smart-ID account, suspend your ID card certificates if needed, and change your Mobile-ID PIN codes.
Then tell the bank which data you shared and which transactions look suspicious.
2
Collect evidence and do not delete any communication
Save anything that may be important straight away: messages, emails, chats in messaging apps, phone numbers, website addresses and a bank statement showing the suspicious transactions.
This information will be needed by both the bank and the police.
3
Report it to the police and, if needed, to RIA
File a report with the police. Report the incident even if you did not lose any money. Every report can help identify and stop fraudsters.
Report suspicious links, fake websites and cyber incidents to RIA.
4
Be alert to follow-up scams
After fraud has taken place, fraudsters may contact you again claiming they can help recover your money. This is a separate fraud scheme.
Only trust the bank, the police and RIA through their official channels.
Important to know
If the verification code, service provider or action description shown in the Smart-ID or Mobile-ID app does not match the action you started yourself, do not confirm it.
• PIN1 is needed to access e-services, such as logging in to the Internet bank.
• PIN2 is needed to confirm actions, such as making a bank transfer, confirming changes to a contract or providing an electronic signature.
Check which transactions have been made using your authentication methods.
Review transactions
Protect your account
Never share your PIN codes with anyone, including the bank, the police or any other public authority.
Before entering a PIN code, always check the service provider's name and the action description in the Smart-ID or Mobile-ID request. If you did not initiate the request yourself, cancel it, do not enter your PIN code and notify the bank. Be especially cautious if you are asked to enter PIN codes during an ongoing phone call.
If you suspect that someone has gained access to your authentication methods, block them immediately.
• You can close your Smart-ID account in the Smart-ID app or through their self-service.
• To close your Mobile-ID, contact your mobile network operator.
Before entering a PIN code, always check the service provider's name and the action description in the Smart-ID or Mobile-ID request. If you did not initiate the request yourself, cancel it, do not enter your PIN code and notify the bank. Be especially cautious if you are asked to enter PIN codes during an ongoing phone call.
If you suspect that someone has gained access to your authentication methods, block them immediately.
• You can close your Smart-ID account in the Smart-ID app or through their self-service.
• To close your Mobile-ID, contact your mobile network operator.
Set your daily transfer and card payment limits in line with your usual spending. This helps reduce potential losses if your card or account details fall into the hands of fraudsters. Enable transaction notifications so you can spot suspicious activity as quickly as possible.
You can change your Holm credit card limits through our self-service.
You can change your Holm credit card limits through our self-service.
Always make sure you are logging in to self-service on Holm Bank’s official website, holmbank.ee. If you have even the slightest doubt about an email, message or call you have received from the bank, contact our customer support.
Please note that Holm always sends emails from addresses ending in @holmbank.ee, and messages come from the sender “Holm Bank”. However, sender names in messages can be forged, so always pay attention to the content of the message, the links and the actions you are asked to take.
Please note that Holm always sends emails from addresses ending in @holmbank.ee, and messages come from the sender “Holm Bank”. However, sender names in messages can be forged, so always pay attention to the content of the message, the links and the actions you are asked to take.
Warning signs and types of fraud
Fraudsters send SMS messages, emails or social media messages that appear to come from a bank, courier company or public authority. The message includes a link to a fake website that imitates a familiar environment. Fraudsters aim to make you enter your banking details, PIN codes or personal data.
How to recognise fraud
• The email or message contains a link and urges you to click it immediately.
• You are asked to "confirm" or "update" your information.
• The sender's email address or the website address contains spelling mistakes or differs slightly from the genuine address.
• A sense of urgency is created, for example by claiming that your account will be blocked unless you act immediately.
How to protect yourself
Do not click on suspicious links or enter your PIN codes, banking details or personal data on a website unless you are certain it is genuine. The bank will never send you links asking you to enter your PIN codes or personal information. If you have any doubts, go directly to the service provider's website instead of using the link in the message.
How to recognise fraud
• The email or message contains a link and urges you to click it immediately.
• You are asked to "confirm" or "update" your information.
• The sender's email address or the website address contains spelling mistakes or differs slightly from the genuine address.
• A sense of urgency is created, for example by claiming that your account will be blocked unless you act immediately.
How to protect yourself
Do not click on suspicious links or enter your PIN codes, banking details or personal data on a website unless you are certain it is genuine. The bank will never send you links asking you to enter your PIN codes or personal information. If you have any doubts, go directly to the service provider's website instead of using the link in the message.
On social media or over the phone, you may be offered the opportunity to earn high returns in a short period of time. You are given access to an investment platform where your investment appears to grow. However, when you try to withdraw your money, obstacles arise. You may be asked to pay additional fees, taxes or "income tax", or be told that your funds are "locked".
How to recognise fraud
You are promised guaranteed high returns with no risk.
The investment platform is unfamiliar, recently created or can only be accessed through an advertisement.
Communication takes place mainly via Telegram, WhatsApp or social media.
You are repeatedly asked to make additional payments before you can withdraw your money.
How to protect yourself
Be cautious of offers that promise quick and guaranteed profits. Do not transfer money to an unfamiliar platform or share your banking details or authentication codes. Before investing, check that the service provider is properly authorised, and remember: if you are repeatedly asked to pay more to withdraw your money, it is a strong warning sign.
How to recognise fraud
You are promised guaranteed high returns with no risk.
The investment platform is unfamiliar, recently created or can only be accessed through an advertisement.
Communication takes place mainly via Telegram, WhatsApp or social media.
You are repeatedly asked to make additional payments before you can withdraw your money.
How to protect yourself
Be cautious of offers that promise quick and guaranteed profits. Do not transfer money to an unfamiliar platform or share your banking details or authentication codes. Before investing, check that the service provider is properly authorised, and remember: if you are repeatedly asked to pay more to withdraw your money, it is a strong warning sign.
The caller introduces themselves as a bank employee, police officer or tax official and claims that suspicious activity has been detected on your account or that a secret operation is under way. They try to create panic and a sense of urgency so that you enter your PIN codes, disclose your details or transfer money to a "safe account". Fraudsters may also use artificial intelligence to imitate the voice of someone you know.
How to recognise fraud
• The caller pressures you to act immediately and does not give you time to think.
• You are asked to enter a Smart-ID or Mobile-ID code for an action you did not initiate yourself.
• They mention a "safe account", "account freezing" or a "police operation".
• The caller asks you to install remote access software on your computer, such as AnyDesk or TeamViewer.
• The phone number may appear to be the bank’s official number, as phone numbers can be spoofed.
How to protect yourself
Neither the bank nor the police will ever ask you to enter PIN codes, install remote access software or transfer money to a "safe account". If you have any doubts, end the call and contact the bank or public authority yourself using the phone number shown on their official website.
How to recognise fraud
• The caller pressures you to act immediately and does not give you time to think.
• You are asked to enter a Smart-ID or Mobile-ID code for an action you did not initiate yourself.
• They mention a "safe account", "account freezing" or a "police operation".
• The caller asks you to install remote access software on your computer, such as AnyDesk or TeamViewer.
• The phone number may appear to be the bank’s official number, as phone numbers can be spoofed.
How to protect yourself
Neither the bank nor the police will ever ask you to enter PIN codes, install remote access software or transfer money to a "safe account". If you have any doubts, end the call and contact the bank or public authority yourself using the phone number shown on their official website.
Fraudsters pose as buyers or sellers on online marketplaces, such as Facebook Marketplace, and send fake payment links that imitate a bank, courier service or online shop. Sellers may be promised an advance payment that never arrives or receive a fake proof of payment. Buyers may pay for goods that are never delivered.
How to recognise fraud
• The payment link is sent through a messaging app, such as Messenger or WhatsApp.
• The link does not lead to the official website of a bank, courier service or online shop.
• The other party refuses to meet in person or allow you to inspect the item.
• You are asked to provide your card details or authentication codes, or to confirm the transaction using your authentication method.
How to protect yourself
Do not click on suspicious payment links or enter your card details on a website unless you are certain it is genuine. Always check the website address and use official payment and delivery methods whenever possible. Do not confirm any action using Smart-ID, Mobile-ID or your ID card unless you initiated it yourself.
How to recognise fraud
• The payment link is sent through a messaging app, such as Messenger or WhatsApp.
• The link does not lead to the official website of a bank, courier service or online shop.
• The other party refuses to meet in person or allow you to inspect the item.
• You are asked to provide your card details or authentication codes, or to confirm the transaction using your authentication method.
How to protect yourself
Do not click on suspicious payment links or enter your card details on a website unless you are certain it is genuine. Always check the website address and use official payment and delivery methods whenever possible. Do not confirm any action using Smart-ID, Mobile-ID or your ID card unless you initiated it yourself.
You meet someone on social media or a dating app who seems kind, caring and trustworthy. The relationship develops quickly, but meeting in person is always postponed. Over time, they ask you for money, claiming it is needed for an emergency, medical expenses, travel costs or an investment opportunity. Once the money has been sent, communication becomes less frequent or stops altogether.
How to recognise fraud
• You have never met the person in real life, and they refuse to have a video call.
• The relationship develops unusually quickly, and the other person is exceptionally attentive.
• They ask you for money, often claiming there is an urgent problem.
• You are asked to transfer money abroad, send it as cryptocurrency or pay it through a third party.
How to protect yourself
Do not transfer money to someone you have never met in person. Be cautious if a new acquaintance avoids meeting or having a video call but asks you for money to deal with an urgent situation.
How to recognise fraud
• You have never met the person in real life, and they refuse to have a video call.
• The relationship develops unusually quickly, and the other person is exceptionally attentive.
• They ask you for money, often claiming there is an urgent problem.
• You are asked to transfer money abroad, send it as cryptocurrency or pay it through a third party.
How to protect yourself
Do not transfer money to someone you have never met in person. Be cautious if a new acquaintance avoids meeting or having a video call but asks you for money to deal with an urgent situation.
On social media, classified ad portals or messaging apps, you may be offered an unusually favourable loan or a simple, well-paid job. In the case of a job offer, the “work task” may turn out to involve moving other people’s money through your bank account. This is money laundering and is punishable by law.
How to recognise fraud
The loan offer is unusually favourable and does not require collateral.
You are asked to make various advance payments to receive the loan.
During the application process, you are asked to make a payment, for example for a background check or document processing.
The employer asks you to share your banking details or confirm actions using an authentication method.
How to protect yourself
Do not make advance payments to receive a loan or share your banking details with an unknown lender or job provider. Always check that the lender or employer actually exists, and be cautious of offers that promise large rewards quickly and with little effort. Do not use your bank account to transfer someone else’s money.
How to recognise fraud
The loan offer is unusually favourable and does not require collateral.
You are asked to make various advance payments to receive the loan.
During the application process, you are asked to make a payment, for example for a background check or document processing.
The employer asks you to share your banking details or confirm actions using an authentication method.
How to protect yourself
Do not make advance payments to receive a loan or share your banking details with an unknown lender or job provider. Always check that the lender or employer actually exists, and be cautious of offers that promise large rewards quickly and with little effort. Do not use your bank account to transfer someone else’s money.
Businesses are often attractive targets for fraudsters because the potential financial losses can be significant. Common fraud schemes exploit everyday business processes, such as payments, email communication and employees' trust.
Email spoofing
A fraudster sends an email to an employee that appears to come from a manager, colleague or business partner. The email may ask the employee to update banking details or make a payment to a new bank account.
CEO impersonation
An accountant or another employee responsible for payments receives an email that appears to come from the company's CEO or manager. The message usually requests an urgent bank transfer and stresses that the matter is confidential.
Fake invoices
A business receives a professionally designed invoice with bank account details that differ from those of the genuine business partner.
Employee phishing
An employee is tricked into entering their username or password on a fake website or downloading a file containing malware.
How to recognise fraud
You receive an unexpected email notifying you that banking details have changed.
A payment request is marked as urgent or you are told to keep it confidential.
The sender's email address differs from the genuine one by just one letter, symbol or domain name.
The invoice is missing the usual references, such as a contract or order number.
The payment details, amount or payee differ from previous information.
How to protect yourself
Always verify requests to change banking details and unusual payment requests through a different communication channel. For example, call your business partner or manager directly using a phone number you already know. Do not use the phone number provided in the email and do not reply to the same email.
Email spoofing
A fraudster sends an email to an employee that appears to come from a manager, colleague or business partner. The email may ask the employee to update banking details or make a payment to a new bank account.
CEO impersonation
An accountant or another employee responsible for payments receives an email that appears to come from the company's CEO or manager. The message usually requests an urgent bank transfer and stresses that the matter is confidential.
Fake invoices
A business receives a professionally designed invoice with bank account details that differ from those of the genuine business partner.
Employee phishing
An employee is tricked into entering their username or password on a fake website or downloading a file containing malware.
How to recognise fraud
You receive an unexpected email notifying you that banking details have changed.
A payment request is marked as urgent or you are told to keep it confidential.
The sender's email address differs from the genuine one by just one letter, symbol or domain name.
The invoice is missing the usual references, such as a contract or order number.
The payment details, amount or payee differ from previous information.
How to protect yourself
Always verify requests to change banking details and unusual payment requests through a different communication channel. For example, call your business partner or manager directly using a phone number you already know. Do not use the phone number provided in the email and do not reply to the same email.