Searches for "phishing" are surging — the term spiked 1,000% in the Netherlands in the last 24 hours, with more than 20,000 searches, as a fresh wave of scam emails and texts hit Dutch inboxes this week. It's part of a pattern running on both sides of the Atlantic: criminals are building fake websites that look exactly like your bank, your energy provider, or the shop you just ordered from — and AI is making the fakes harder to spot than ever.
This guide explains what a phishing website actually is, the six phishing campaigns hitting shoppers in the US and Europe right now, the fake-reviews trick that makes bogus sites look legitimate, the eight red flags to check before you click, and the 60-second verification routine that tells you whether a link is safe.
1. What a phishing website actually is — and why it's trending today
A phishing website is a fake site built to look like a company you trust — your bank, a parcel carrier, an energy provider, an online shop — so that when you type in your login details, card number, or personal data, those credentials go straight to a criminal.
The Dutch "phishing" spike is a textbook example of how these waves work. Over 17–19 October, security outlets flagged fake "energy debt" emails impersonating Netbeheer Nederland — the Dutch grid operator — warning recipients they owed money and had to pay immediately through a linked site. Energy provider Liander published its own warning about the campaign. Separately, scammers exploited a DNB (De Nederlandsche Bank) login outage on 19 October, sending messages that played on the disruption to harvest banking credentials. The Dutch police and Public Prosecution Service's Cybercrimebeeld Nederland 2026 puts the scale in context: roughly 2.5 million Dutch people were victims of cybercrime and scams in 2025 alone.
Phishing works because it piggybacks on moments of attention — an outage, a bill, a delivery — and turns a quick, unthinking click into stolen credentials.
2. Why fake websites got harder to spot in 2026: AI's new role
The old phishing site looked broken — mismatched fonts, crooked logos, obvious typos. That gave shoppers a fighting chance. Today's fakes don't look broken, and that's the problem.
On 19 October 2026, the BBC reported on Britain's National Trading Standards publishing an AI Scam Watchlist: criminals are now using AI to fabricate convincing fake online shops — inventing plausible business histories and generating images of a "traditional high street" storefront complete with Union Jacks to make a site that exists nowhere look like it's been trading for years. The Watchlist also flags that fake reviews are being used to strengthen these fraud schemes — the same fake-review machinery this site's checker was built to expose is now propping up fake websites. Some 47% of UK adults say it's harder to tell what's genuine online than it used to be.
INTERPOL, for its part, launched an October 2026 awareness campaign against AI deepfake scams — impersonation, investment, and romance fraud using cloned voices and fabricated video. The pattern is the same everywhere: AI lowered the cost of looking trustworthy, and phishing sites are spending that budget.
3. The six phishing campaigns hitting shoppers right now
These are the active campaigns worth knowing about this week:
1. The Netbeheer Nederland "energy debt" emails (Netherlands). Fake messages claiming you owe money on your energy bill, pushing you to pay through a linked phishing site. Liander issued a warning; security outlets flagged the campaign on 17–19 October.
2. DNB login-outage scams (Netherlands, 19 October). Scammers exploited a real De Nederlandsche Bank login outage, sending credential-harvesting messages that fed on the disruption and the news coverage around it.
3. AI voice-cloning bank "helpdesk" calls (Netherlands/Europe). Alerts from early October describe scammers calling with AI-cloned voices, posing as bank fraud departments, then directing victims to fake "verification" sites.
4. Fake Ledger firmware-update phishing (global crypto holders). A phishing campaign is riding on the 17 October $86M Ledger spyware hack — messages pushing malicious "firmware updates" that drain wallets instead. We saw the same Ledger angle in an earlier phishing wave; the machinery is reusable and it comes back with every crypto headline.
5. "Storage is full" texts (United States). The BBB flagged phishing texts claiming your phone or cloud storage is full, linking to sites that harvest credentials and card details.
6. FTC refund-check impersonation (United States). Real FTC refund checks are going out for Walmart money-transfer scams — which means impersonation scams around "your refund" and "verify your details" are close behind, a classic pattern with every official payout program.
Different bait, same hook: urgency plus a link that doesn't go where it claims.
4. The fake-reviews trick: how phishing sites borrow trust
Here's the part most people miss. A bare phishing site is suspicious — no history, no social proof, no reason to trust it. So scammers solved that problem the same way dishonest sellers do: they dress the fake site in fake reviews.
National Trading Standards' AI Scam Watchlist (19 October) specifically flags fake reviews being used to strengthen fraud schemes — a scam site loaded with glowing "customer" testimonials converts far better than one without. The reviews are planted on the fake shop itself, or on review platforms that point back to it, creating a loop of borrowed credibility: the site looks reviewed, so it looks real.
This is where the site's two tools work together. If the site you're being pushed toward carries suspiciously uniform praise — five-star raves with no specifics, review floods in a single week, language that reads like it came off an assembly line — copy the review text and paste the review text into our free fake review checker (it analyzes the words you paste in — review text only). Then, for the site itself, run the suspicious link through our website scam checker. Fake site plus fake reviews is the full signature of the modern phishing operation.
5. Anatomy of a phishing site: the eight red flags
Before you enter anything — before you even click — check the link against these:
1. The domain doesn't match the brand. dnb-secure-login.example.com is not DNB's site, however official it looks. Scammers register lookalike domains and bury the brand name deep in subdomains. Read the domain right-to-left: the part just left of the .com/.nl/.de is what actually owns the site.
2. Misspellings and character swaps. ledqer.com, arnazon-deals.nl, netbeheer-betalingen.nl — swapped letters, extra hyphens, and "official-sounding" suffixes are the classic move. Legitimate companies use their real domain, always.
3. Urgency that blocks thinking. "Your account will be suspended in 24 hours." "Pay this debt today or face disconnection." Real banks and energy companies don't demand instant action through an unsolicited link — and the Dutch energy-debt campaign this week proves criminals know urgency is their best weapon.
4. An SSL padlock is not a green light. Many phishing sites now have HTTPS. A padlock means the connection is encrypted — it says nothing about who is on the other end.
5. Content that feels off in your language. On Dutch, German, or French phishing pages, watch for phrasing that reads like a machine translation — stiff, oddly formal, inconsistent with how a real provider writes. AI made English phishing flawless; the non-English versions still slip.
6. Fake trust badges and fabricated legitimacy. Borrowed logos, invented "verified shop" seals, AI-generated storefront photos — the exact tricks flagged in the Trading Standards AI Scam Watchlist. Anyone can paste a badge; what matters is whether it links to a real verification page.
7. Review sections that read like marketing copy. The reviews section glows but no reviewer has a history, every "customer" is anonymous, and the language repeats itself. Run suspicious text through the fake review checker.
8. Requests for credentials a real company never asks for by link. A bank will not text you a login link. An energy provider will not email you a "pay now" button. A parcel carrier will not ask for card details by SMS. If the channel is unsolicited and the link demands credentials, stop.
6. The 60-second verification routine before you click or buy
When a link looks even slightly off, run this routine — it takes a minute:
1. Hover (don't click). On desktop, hover over the link to see the real destination. On mobile, long-press to preview the URL. Compare it against the company's real domain — type that domain yourself rather than trusting the link.
2. Run the link through our website scam checker. Paste the suspicious URL into the checker before you open it. It looks at the site's signals — domain history, registration patterns, and known scam markers — and tells you whether the link is safe to open.
3. Check the domain's age. A "bank" whose domain was registered three days ago is not a bank. Public WHOIS lookups take seconds and phishing domains are overwhelmingly young.
4. Search the brand + "scam". "[Company] phishing scam October 2026" will surface warnings like the Liander and DNB alerts within days of a campaign starting.
5. Go direct, always. The safest link is the one you typed yourself. Open your banking app, type the energy company's address from your bill, or use the bookmarked shop page — never the link that arrived uninvited.
One rule covers all of it: unsolicited link plus demanded credentials equals no.
7. What to do if you already clicked or entered your details
Don't panic — act fast and in this order:
1. Change the password immediately — on the REAL site (type the address yourself), and on any other account that shares the password.
2. Call your bank or card issuer using the number on your card or official statement, not any number in the phishing message. Ask them to watch for fraudulent transactions.
3. Enable two-factor authentication on the affected accounts — authenticator-app based, not SMS where possible.
4. Report it. In the US: ReportFraud.ftc.gov (the FTC's reporting portal) and the FBI's IC3 at ic3.gov. In Europe: report to your national consumer protection authority or police cybercrime unit (e.g., the Dutch police via politie.nl, the UK's Action Fraud), and forward phishing texts/emails to your carrier.
5. Watch your credit. Pull a free credit report (US: AnnualCreditReport.com) and consider a temporary credit freeze if identity details were entered. In the EU, check your national credit register options.
6. Document everything. Screenshots of the message, the URL, and any confirmation pages help investigators and your bank's fraud team.
Speed matters more than perfection here: every minute the credentials are valid is a minute the scammer can use them.
8. Quick answers: phishing questions people actually ask
Can a phishing site have a padlock / HTTPS? Yes — most do now. The padlock only encrypts the connection; it doesn't verify who's running the site. Never treat HTTPS as a trust signal by itself.
What if the link came by text or WhatsApp? SMS and messaging apps are now the top phishing delivery channels in Europe (see this week's Dutch campaigns). The medium doesn't change the rule: don't open unsolicited links; go to the company directly.
Can your website scam checker catch phishing sites? It's built for exactly this — analyzing a site's domain and scam signals before you engage. No checker catches 100% of brand-new domains (criminals spin up fresh ones daily), so pair the check with the 60-second routine above.
Should I report a phishing text I didn't fall for? Yes — every report helps. Forward it to your carrier, report it to the FTC or your national authority, and tell the impersonated company. Your report is how warnings like Liander's get out in days instead of weeks.
Is this website safe? When in doubt, assume no — and verify. Run the URL through our website scam checker, check the domain age, and type the real company's address yourself — our is-this-website-legit guide walks through the full method.
Sources: Google Trends — daily trending searches, Netherlands, 2026-10-19 ("phishing", 20K+ searches, +1,000%); BBC News, 2026-10-19 ("AI gives fake shops a convincing new face" — National Trading Standards AI Scam Watchlist); INTERPOL October 2026 AI-deepfake scam awareness campaign; Liander warning + Malwaretips reporting, 17–19 Oct 2026 (Netbeheer Nederland "energy debt" phishing); Adresseavisen/VG, 2026-10-19 (DNB login-outage scam warnings); The Dutch Daily, 2026-10-05 (AI voice-cloning bank fraud alerts); Dutch police/OM, Cybercrimebeeld Nederland 2026 (~2.5M Dutch cybercrime/scam victims in 2025); BBB warnings (storage-full phishing texts); Dunlap.Today scam watch, 2026-10-16 (FTC Walmart money-transfer refund checks); FTC ReportFraud.ftc.gov; FBI IC3 (ic3.gov).
Explore the evidence behind your next question.
Start a website check