A fake bank-link page: how to recognise Trustly-style fraud

A bank-link payment is one of the safer ways to deposit at a casino, precisely when it is genuine. You do not enter card details at the casino; you log in to your own bank and confirm the payment there. But fraudsters know this too. That is why fake payment pages are built that look like your bank's or Trustly's page, with the sole aim of getting your login details.

This article explains what a genuine bank-link payment looks like, six signs that something is wrong, and what to do if you have already entered your details. If you first want to know how Trustly works, start with the page How Trustly works.

What a genuine payment looks like

A genuine payment always follows the same pattern. If any of these steps is different, there is reason to stop.

1. At the casino you choose the bank link and enter an amount. No bank detail is asked of you here.
2. You are sent to the payment provider's page, where you choose your bank. You see the provider's name and the amount you chose.
3. You are sent to your bank's own page. The address bar shows the bank's well-known domain.
4. You log in the bank's usual way, such as Smart-ID, Mobile-ID or an ID card, and confirm the payment. At confirmation you see the amount and the recipient's name.
5. You are sent back to the casino, and the balance updates.

What matters are steps three and four. Login and confirmation always happen in the bank's own environment. Behind this design is the payment services directive PSD2, which requires strong customer authentication when confirming payments. Background on the concepts is in the Wikipedia article on open banking, and official information is on the Trustly site.

Six signs that a page is fake

1. The address is not the bank's address

Look at the address bar before you enter anything. Fakes use similar names, added words (such as "secure" or "login"), a different top-level domain or typos. A padlock in the address bar does not mean the page is trustworthy: it means only that the connection is encrypted, and fraudsters can get exactly the same certificates. The best habit: open your bank through a bookmark or the app, and check that it is the same page.

2. You were sent through a link in an email, message or chat

A genuine payment starts on the casino page you opened yourself. A link that arrived by email, SMS, Telegram or chat ("your deposit failed, confirm here") is not the casino's payment flow. If in doubt, open the casino yourself and check the balance and transaction history.

3. It asks for PIN codes the bank does not ask for

At login you confirm with PIN1 or a Smart-ID confirmation, and that happens in the app or card reader, not on the casino page. If a page asks you to enter PIN1 and PIN2 together, card details, code-card codes or a "security code" without the usual confirmation, it is fraud. A bank never asks for your PIN codes by phone or email.

4. You are being rushed

"Your account will be locked in 10 minutes", "the bonus expires now", "confirm immediately or lose your money". Urgency is a fraudster's tool, because a calm person checks. A genuine payment waits as long as you need. If a casino or bank has something to tell you, it will show up when you log in to your own account, not as an instant message.

5. A remote-access app is requested

If anyone asks you to install a program that lets them see and control your computer or phone (such as AnyDesk or TeamViewer), stop immediately. No casino, bank or payment provider needs remote access to your device. Through it a fraudster can make payments in your name with your own confirmations.

6. The confirmation shows an amount or recipient that is not yours

Before you confirm, read the confirmation text. Smart-ID shows a verification code that must match the one on your screen, and the bank's confirmation shows an amount and a recipient. If the amount is larger than your deposit, or the recipient's name has no link to the payment provider, abort. This is the most reliable check, because a fake page cannot change what appears in your bank's app.

What to do if you entered your details

Time counts. Take the following steps in order, and do not delay:

1. Call your bank on the number printed on your card or on the bank's official site, not on the page where the suspicion arose. Say you have entered details on a fake page and ask for the account to be blocked.
2. Change passwords on every service where you used the same one, and switch on two-step verification.
3. Check your bank account: open the statement and look for transactions you do not recognise. The sooner you notice, the greater the chance of stopping a payment.
4. Report the incident to the police (politsei.ee) and the fraud to CERT-EE, which handles Estonian cyber incidents.
5. Preserve the evidence: screenshots, the link, the messages you received and times. You will need them for both the bank and the police. How to document problems is explained in our sister site's article how to document a withdrawal problem.
6. Do not pay for a "refund" and do not trust anyone offering to "recover" your money for a fee. That is the second wave of the fraud.

Protection that works before there is a problem

• Set a daily limit in your internet bank at a level that covers your real use. A lower limit caps the damage if the details fall into the wrong hands.
• Open the payment provider's and casino's pages from bookmarks.
• Keep your device and browser up to date. An introduction to Estonia's national cyber-security work is on the RIA website, and the Estonian Banking Association gives sensible general information about fraud on its site.
• Use one casino you have checked yourself, not ten whose names you found in a newsletter.

The glossary has short explanations of the terms: bank link, bank payment and verification. If a bank payment has simply not arrived but the page was genuine, the causes are different and the fixes are in When a bank payment does not arrive. Which banks support Trustly is in Which Estonian banks support Trustly payments. Our methodology page explains how we check casinos' payments ourselves, and you will find a selection of Estonian-licensed casinos here. The freespin.ee article on bank-link payments looks at the same subject from another side, and the Wikipedia article on phishing gives a shared vocabulary.