News
What is phishing and how to protect your digital wallet
A message from your digital wallet alerts you that suspicious access was detected. It has the right logo, the right tone, and a button that says "Verify now."
The only thing missing is for it to be real. According to data from the Anti-Phishing Working Group, more than 4.7 million phishing attacks were recorded globally in 2023, and the financial sector was the most targeted.
Most victims didn't fall for it out of carelessness, but because the message looked legitimate.
Phishing is an impersonation technique where someone poses as a trusted company, platform, or person to get you to hand over sensitive data. Passwords, verification codes, card numbers, access to your account.
The mechanism varies in format, but the logic is always the same: create urgency so you act before you think.
The most common channels are email, SMS (a variant known as smishing), WhatsApp, and social media.
An email can mimic the entire aesthetic of your digital wallet, complete with a similar domain and corporate signature. An SMS might arrive with a shortened link and an "account locked" notice.
On WhatsApp, the attack usually comes with an official logo and an alleged support agent who needs to "verify your identity." Each channel adapts the format, but they all seek the same thing: to get you to click or share data without stopping to confirm.
How to recognize a phishing message
The difference between falling for it and not falling for it lies in spotting details that a legitimate message would never have. There are four red flags that recur in almost every attempt.
The four most common warning signs
The sender does not match the official domain. A real email from a financial platform comes from a verified domain. If the email arrives from something like "support@secuure-wallet.com" (with duplicated letters, strange characters, or generic domains), it's fake.
In SMS, unknown numbers or international area codes that don't correspond to the company are an immediate red flag.The link uses a domain different from the original. Before tapping any link, press and hold it to see the full URL. Phishing sites use domains that resemble the original but include extra words or strange extensions, such as "digital-wallet-security.site/verify" instead of the app's real domain.
The message creates manufactured urgency. Phrases like "Your account will be suspended in 2 hours" or "If you don't respond, you will lose access" are designed to keep you from thinking. No reputable platform gives you a window of just a few hours to resolve a security issue via a message.
They ask for your verification code. That code that arrives via SMS when you log in or make a transaction exists to protect you. If someone asks for it over chat, phone, or email, they are trying to access your account from another device and need that number to complete the login. No digital wallet will ever ask you to share that code through any channel.
A typical simulated message looks like this: "Dear user, we detected unusual activity on your account. To prevent suspension, verify your identity by visiting [suspicious link]. You have 24 hours."
Everything looks professional, but it combines all four red flags: a generic sender, a suspicious link, urgency, and an implicit request for credentials.
How to prevent phishing on your wallet
Recognizing the signs helps, but real protection comes from habits that render any attempt useless, even if a message manages to look convincing.
Enabling two-factor authentication is the most effective measure. With two-factor authentication enabled, even if someone obtains your password, they cannot access your account without the second verification step that only you control. Most digital wallets offer this option in their security settings.
To confirm whether a communication is real, the safest route is to go directly to the app, without following links from messages or replying to SMS, and without chatting with "agents" who reach out to you first.
At belo, all official communication with support is handled through the Help Center inside the app (Profile, Help Center), with human support available 24/7.
Any message arriving outside of that channel asking for personal data, passwords, or codes is fake.
No digital wallet will ask you via message for your password, verification code, full card details, or to install apps from an external link. If a message asks for any of those things, you already have your answer.
What to do if you already shared your data
If you already entered data on a suspicious site or shared a code, every minute counts. The order of actions matters.
Steps to take immediately
Change your account password from the official app, never from any link you received. If you use the same password on other services (email, social media), change those as well.
Review your account's recent activity to spot transactions you don't recognize. If you find anything unusual, take screenshots of every suspicious transaction, the message you received, and any sender information, as these screenshots serve as evidence for the dispute process and for an eventual formal report.
Contact your digital wallet's official support from within the app, never from the same channel where the fraudulent message arrived. Report what happened with as much detail as possible: what data you shared, when, and through what medium, so the team can freeze transactions, deactivate cards, and secure your account.
If there was a financial loss, file a report with your country's cybercrime unit. In Argentina, the Specialized Fiscal Cybercrime Unit (UFECI) handles phishing reports. Saving receipts, screenshots, and the entire message thread strengthens any subsequent claim.
The mechanics of phishing rely on you acting quickly without verifying. Your best tool is the exact opposite: slow down, check the sender, confirm from within the app, and never share data that the platform already has.
Frequently asked questions about what phishing is and how to protect your digital wallet
Does phishing only happen via email?
No. Although email is one of the most widely used channels, phishing attacks also arrive via SMS, WhatsApp, and social media. Each channel adapts the message's format, but the goal is always the same: to get you to hand over sensitive data without verifying the source.
What changes is the appearance: an SMS mimics a security alert, while a WhatsApp message pretends to be a support agent. The logic behind it is identical in all cases.
What happens if I clicked the link but didn't enter any data?
Just clicking on some malicious links can expose device information or place you on a list of active targets. Even if you didn't enter any data, it's best to close the site immediately and check your account activity.
Enabling two-factor authentication if you don't already have it is the most helpful next step. It significantly reduces risk even if your device was exposed.
How do I know if the phone number or email that messaged me is really from my wallet?
The only safe way to verify it is to open the official app and check the authorized contact channels from there. Companies publish their official channels directly within the platform, and any communication arriving outside of those channels asking for data should be treated as suspicious.
At belo, every legitimate inquiry goes through the Help Center inside the app. If someone contacts you through another medium asking for your account information, it's not belo.
Does two-factor authentication protect me even if I fall for a phishing scam?
In most cases, yes. If someone gets your password but doesn't have access to the second factor, they cannot complete the login to your account. That is why enabling it is the most effective single measure against these types of attacks.
Two-factor authentication isn't foolproof if you share the verification code directly, but it protects against any scenario where only the password was exposed.
Can I report a phishing attempt even if I didn't lose any money?
Yes. Reporting the attempt to your digital wallet's support team helps the platform block the fraudulent sender or link, protecting both you and other users. In Argentina, you can also file a report with UFECI even if there was no financial loss.
Saving screenshots of the message, the sender, and the full sequence makes the report more useful and facilitates any subsequent follow-up.
