Fake texts from bpost, itsme or the bank: what should you tell your team?

Why the whole team needs to hear this

Fake texts do not only target private individuals. The reception phone, the manager’s work mobile or an assistant’s phone get the same messages as everyone else. And in a business, a single click can cost money, or open up access to an account.

First, two terms. Phishing is a fake message that imitates a trusted organisation to get you to click, pay or hand over your codes. When it arrives by text message, it is called smishing.

The Belgian figures show the scale. They come from Febelfin’s 2025 report (in French), the Belgian banking federation, which also draws on data from Safeonweb, the service run by the Centre for Cybersecurity Belgium:

• Nearly 26,000 reports a day of suspicious messages to Safeonweb, or around 9.5 million a year.
• €49 million stolen through phishing in 2024.
• 75% of fraudulent transfers detected, blocked or recovered by the banks.
• 13% of Belgians surveyed say they have already been a victim.

How a simple parcel text turns into fraud

Example, made up for illustration. One Tuesday morning, the secretary at a dental practice gets a ‘bpost’ text on the reception phone: a parcel is waiting, and a few euros in fees are still due before it can be delivered. The practice happens to be expecting equipment. She clicks, lands on a page in bpost colours and types in the practice’s debit card.

The next day, a ‘bank employee’ calls. Suspicious payments have been spotted, he says, and they need to be cancelled by confirming them in itsme. In reality, each confirmation approves a payment to the scammer.

This second step is not made up: Febelfin describes it in its report. Victims think they are cancelling suspicious payments through itsme and are in fact approving the fraudster’s. Febelfin also notes that fraudsters are more and more often persuading victims to make the transfer themselves. The text is often just the way in.

The most common fake texts, and what the real sender never does

Messages in the name of a health insurance fund or INAMI-RIZIV (mostly by email) and of a water company (by email and text) were among the most reported to Safeonweb in the first half of 2025, according to the list of the ten most reported messages that Safeonweb published in August 2025 (republished here by Forum for the Future, in French). The logo, the familiar name and the official tone prove nothing: they are exactly what fraudsters copy.

Five rules to give your team

1. A message that rushes you is a signal to stop. A 24-hour deadline, a threat to block, small fees to pay: the urgency is there to stop you thinking. bpost puts it plainly: if it feels urgent, it is most likely a scam.
2. Don’t click the link, go there yourself. For a parcel, the My bpost app. For the bank, its app or its website typed in by hand. For itsme, the itsme app.
3. Codes, PIN, card, itsme confirmation: never because someone asks. A bank never asks for your codes. And in itsme, only confirm an action you started yourself: itsme explains that fraud relies precisely on a request you did not initiate.
4. A call that follows a text: hang up and call back. Call the number you know (on the back of the card, in the bank’s app), never the one given by the caller or the message.
5. Report it, without shame. A screenshot of the text sent to [email protected] is enough, as long as the link is visible: no need to copy it out. And tell the person in charge at the office.

The fifth rule matters as much as the others. Someone who is afraid of being judged keeps quiet, and that silence is what turns a click into lost money. Say it clearly: whoever reports quickly does everyone a favour, even if they clicked.

Someone has clicked: what to do

According to the Febelfin survey, 39% of 16 to 30-year-olds would not know what to do after a successful phishing attack, and 27% of 31 to 79-year-olds. Febelfin stresses that how quickly you react often makes the difference between limited losses and serious damage. So it is best to know the answer before you need it.

One point that is often forgotten: the work password. A fake text can lead to a fake email sign-in page rather than a bank page. If someone has typed their password there, the account must be secured the same day, not at the end of the week.

In a healthcare practice: three extra precautions

In a practice, messages in the name of INAMI-RIZIV or a health insurance fund seem natural: refunds come up all day long. And the reception phone often passes from hand to hand. A few simple rules will steer you clear of most of the traps.

• No payment from a link received by text, even for a few euros: parcel fees, a fine, a subscription. A real payment is made from the website or app you know.
• The practice card is never typed into a page opened from a message. If a supplier you are expecting really does need something, call them on the number you already have.
• One name for security questions. Everyone knows who to show a dubious message to, including locums and trainees.

Ten minutes in a team meeting, and it’s done

There is no need for a full-day training course. A short, practical reminder, repeated from time to time, is worth more than a long presentation forgotten the next day.

1. Show two or three real, recent examples, taken from the warnings published by Safeonweb.
2. Read the five rules above together, stressing the last one: report it, without shame.
3. Put up a small sheet near reception with [email protected], Card Stop on 078 170 170, the bank’s number and the name of the person to tell.
4. Do it again whenever someone joins the team, and twice a year for everyone.

These are simple habits, but they change how people react when the message arrives. The goal is not to turn your team into experts: it is for them to have the right reflex. Slow down, check, report.

Prepare your team for fake messages→