Scam messages and bank IDs in Finland 2026: spot the scam and act fast

€148m

attempted scams in 2025

€72.5m

lost to criminals in 2025

€75.5m

stopped or recovered by banks

€28.3m

lost in January–June 2026

What your bank, the police and Kela never ask for

Your bank and the authorities never ask for your online banking codes in a phone call, a text message or an email. Traficom says so, and Finance Finland says the same on behalf of the banks. According to the police, a real police officer never asks for banking codes or for money to be transferred. There is also no such thing as a “safe account” (turvatili) where your money needs to be moved for protection.

How to spot a scam

A scam message wants you to act fast. According to Traficom, scammers often play on urgency or emotions. The message contains a link, and the page behind it looks like your bank’s, Posti’s or Kela’s site and asks for your banking codes or card details.

• ·The message demands action right now or threatens consequences.
• ·The link takes you to a login page although you did not start anything yourself.
• ·The caller says your money is in danger and must be moved to a “safe account”.
• ·The number on your screen looks genuine. Traficom warns that the number does not prove who is calling.
• ·The message comes by WhatsApp or text from a service that does not use them, such as Suomi.fi.

The National Cyber Security Centre (Kyberturvallisuuskeskus) publishes a weekly review of current scams. In October 2026, scam messages circulated in the name of MobilePay and Kanta, among others.

What is already blocked, and what is not

Scams are also fought at network level. Operators must block calls from abroad that show a spoofed Finnish number: for landline numbers since 1 July 2022 and for mobile numbers since 2 October 2023.

SMS sender names have been protectable since 21 February 2024. Under a Traficom regulation, messages sent in an organisation’s name need authorisation from 4 May 2026. Unauthorised messages are blocked or the sender name is changed to “Tuntematon” (unknown), and from 2 November 2026 to “Roskaposti” (spam).

Banks and the operators Elisa, Telia and DNA also work together, so traffic to a phishing site can now be cut within tens of minutes. In addition, since 9 October 2025 banks check that the payee name matches the account number in online payments. If you pay despite a warning, the responsibility for the transfer moves to you.

How to protect your codes

• ·Log in to your online bank with the bank’s app or by typing the address yourself, never from a link in a message.
• ·Do not confirm anything with your codes that you did not start yourself.
• ·Hang up if the caller asks for codes or tells you to move money. Call your bank yourself on the number from its own website.
• ·Check in your online bank which limits you can set for your account and card. Säästöpankki, for example, introduced a daily limit on account payments in August 2025.
• ·Report suspicious messages even if you did not reply. Attempted fraud is worth reporting too.

If you gave your codes or card details

Act at once: the sooner your bank knows, the better the chance of stopping the transfers. Traficom advises the following:

• ·Call your own bank immediately. The bank can close your codes and card and, at best, still stop the transfers.
• ·File a police report online (rikosilmoitus).
• ·Change the passwords of the services where you entered details.
• ·Report the scam to the National Cyber Security Centre. For a text message, a screenshot is enough.
• ·If you need support, contact Victim Support Finland (RIKU).

According to Finance Finland, banks stopped or recovered more than half of the money scammers tried to take in 2025: €75.5 million out of €148 million. So call your bank right away, not the next day.