Real or fake Smart-ID: the 5-second test
Fake Smart-ID prompts are among Estonia's most expensive scams in 2026. Five simple rules to tell a real Smart-ID request from a fake one.
Most of us in Estonia log in to the bank and confirm payments with Smart-ID. That is why scammers have got so good at copying the login prompts that an ordinary user may not spot the difference. Here are five rules that let you tell in 5 seconds whether a Smart-ID prompt is real or fake.
Quick answer
A real Smart-ID shows a verification code only when you started the login yourself. If a Smart-ID request appears when you haven't started anything, it is always a scam. Tap "Cancel" and change your bank passwords straight away.
Rule 1: You start it, no one else
A real Smart-ID login always starts with you: you open the bank app and tap "Log in with Smart-ID". If Smart-ID suddenly opens without you doing anything, someone is trying to scam you right now.
Rule 2: The verification code must match
Real Smart-ID shows a verification code in the app. The same code must appear on the bank's screen, or on the site you're logging in to. If the codes don't match, it's someone else's login. Sometimes Smart-ID asks you to pick the correct code out of three. Choose only the one shown on your screen, and cancel if none of them matches.
Rule 3: Read what you are confirming
Smart-ID shows exactly what you're confirming: "Log in to Swedbank", "Sign contract X", "Transfer €247". If it doesn't match what you actually meant to do, don't confirm it.
Rule 4: The URL is always smart-id.com or your bank's official address
The Smart-ID website is always smart-id.com. Official bank addresses:
- Swedbank:
swedbank.ee - LHV:
lhv.ee - SEB:
seb.ee - Coop Pank:
cooppank.ee
Anything else, such as smart-id.com.security-update.xyz or smart-id-confirmation.eu, is fake.
Rule 5: When in doubt, close and start over
If anything feels off, close the app and the browser, open your bank app on your phone yourself and start the login again. Nothing breaks on the bank's side when you do this, and the scammer loses you at that point.
What to do if you've already confirmed
- Open your bank app straight away and block all your cards (Swedbank: profile → cards → block).
- Call your bank's 24/7 line (Swedbank: 6 310 310).
- Check your balance and report every suspicious transaction to the bank.
- Change your Smart-ID PINs right away.
- File a report with the police online: cyber.politsei.ee/report
How we practise this on the course
On the 2-academic-hour CyberSafe course we put actual fake Smart-ID sites side by side with the genuine ones, and you practise telling them apart on at least 20 different examples. The course costs €150. Join the next group or book your seat.