UniCredit Impersonation Scam Prevention Guide

When this applies

Use this impersonation scam prevention guide if a file or message appears to come from UniCredit, mentions Smart Banking, warns that access is about to expire, and contains a link. A reconstructed example is: the document presents UniCredit and Smart Banking branding, claims urgent action is required before expiry, and sends the reader to `www.digitalni-rozsireni.xyz`. That address is unrelated to an official UniCredit banking domain. For sole traders and small firms, one compromised login may expose the operating account, payment activity, saved beneficiaries, or administrative access. A takeover can also disrupt invoicing and damage customer trust if the compromised account is used for business communications.

Decision steps in order

1. Stop at the file. Do not select its button, link, or expiry notice, and do not forward it to colleagues as an ordinary attachment.
2. Inspect the destination without visiting it. If the displayed or previewed address ends in `.xyz`, including `www.digitalni-rozsireni.xyz`, treat it as fraudulent rather than a UniCredit service.
3. Check the account independently. Use a UniCredit address you already know or the telephone number printed on your bank card or official account documents; never use contact details inside the suspicious file.
4. Apply business controls. Tell the owner, bookkeeper, and anyone with banking permissions not to act on the same message. Temporarily require a second person to review payment, beneficiary, and administrator changes.
5. Preserve and report the evidence. Keep the original message, file, sender details, and visible link, then report them through UniCredit’s verified contact channel and your company’s security contact.

What to do if you already responded

• If you only opened the page, close it and do not submit information.
• If you entered banking credentials, contact UniCredit immediately through a trusted number and ask it to secure online banking access.
• Review recent payments, beneficiaries, contact details, and user permissions with the bank.
• Change any reused password from a trusted device and secure the associated email account.
• If you approved or sent a payment, tell the bank it may be unauthorized and record the time, amount, and destination shown in your account.

Most common warning signals

• The file or message impersonates UniCredit.
• It references Smart Banking to create trust.
• It warns that access or service is about to expire and demands urgent action.
• The link points to `www.digitalni-rozsireni.xyz`.
• The destination uses an unrelated .xyz domain instead of an official UniCredit banking domain.

What to do now

1. Do not open the link or respond to the expiry warning.
2. Check whether the destination is `www.digitalni-rozsireni.xyz` or another unrelated .xyz domain.
3. Verify the account through a known UniCredit address or the number on your bank card or official documents.
4. Warn the business owner, bookkeeper, and every user with banking permissions.
5. Contact UniCredit immediately if any credentials were entered or any payment was approved.
6. Review payments, beneficiaries, contact details, and administrator permissions.

Further reading

• Impersonation Scam Prevention: Verify Before Acting
• Impersonation Scams in 2026: 7 Checks Before Paying
• 2026 screen check: likely safe health ad, but verify before you trust it

FAQ