SafeMailer is a free awareness library. We reconstruct real-world email scams and fake banking login pages, label what gives them away, and explain the habits that make them fail — nothing to buy, nobody to call.
No sign-in · no personal data collected · no support service
This week's case study
Attackers who already hold a password trigger dozens of sign-in prompts overnight, then phone the victim posing as support, asking them to accept “the verification we just sent”.
Each topic is a short, self-contained explainer — how the attack works, what it looks like, and why the countermeasure works.
{{ t.body }}
Why it fails: {{ t.defence }}
Read this before you trust anything on the internet that claims to help with your accounts, including us.
About & editorial policy →Passwords are rarely guessed any more — they are handed over. Every message below is a reconstruction written for teaching purposes, annotated with the details that expose it.
Shorter notes on techniques we are tracking but have not yet seen at scale.
{{ t.body }}
Why it fails: {{ t.defence }}
This is educational information, not personal advice. Always act through your provider's or bank's own official channels — typed by hand, never from a link.
{{ c.body }}
Almost every banking fraud we study starts in email. The inbox is where password resets, statements and one-time codes land — so it is stolen first, and the bank account second. Below: the chain, an annotated fake login page, and the tells.
{{ c.body }}
Same goal, different pretext. Recognise the shape and the wording stops mattering.
{{ b.body }}
Tell: {{ b.tell }}
Background explainers, written so the scam pages elsewhere on this site make sense. General education — not instructions for any one provider, and not personal advice.
{{ g.intro }}
{{ g.note }}
Case studies on email scams, banking fraud and account security, written by our editors.
{{ post.meta }}
{{ post.lede }}
{{ para.text }}
SafeMailer publishes awareness material only. We are not a helpdesk, we cannot access anyone's account, and nobody from SafeMailer will ever contact you about your email or bank.
{{ legal.updated }}
{{ para.text }}
Social accounts are stolen for the same reason inboxes are: they carry trust. A message from a hijacked profile is read, believed and acted on by hundreds of people who know the owner. Both examples below are fictional reconstructions built for teaching.
Six habits, in rough order of how much they buy you. General educational guidance — check your own provider's official help pages for the exact settings.
{{ p.body }}
Educational information only. Recover through the platform's own official account-recovery page, reached by typing the address yourself.
{{ c.body }}
