Just like Santa's truck and Mariah Carey's trills, another holiday sound is already in the air: the sound of bank cards being drained. It has surely happened to you or to someone close to you. An email tempts you with mouthwatering discounts. You fall for an attractive deal, and when you go to collect the goods… something completely different arrives. You get a message about a purchase you don't remember making, you pay for it, and then it turns out there's no option to return it and you've spent money on something utterly useless.
Let whoever has never fallen for such an attack cast the first mouse!
The most direct route is still email. (And shortly after New Year's we'll share the painfully telling results of an experiment that proves it.)
Yes, in recent years e-commerce has offered plenty of convenience. But it also comes with a number of dangers. On the eve of the holidays, I invited Viktor Rachev, a cybersecurity specialist at the specialized company SoCyber, to help us with practical advice on what to watch out for.
Read it, think it over. Show it to your family and friends too. It could well help you avoid an unpleasant mistake.
1. Check the sender's email address
Don't look only at the name—look at the whole email address. Scammers often use addresses that merely resemble the official ones, with small spelling mistakes or a different domain (for example, [email protected] instead of [email protected]).
2. The greeting is too generic
If you get an email from your bank or another institution that knows your details, it will most likely address you by name. Be suspicious of generic greetings such as
“Dear Customer” or “Dear User.”
3. A sense of urgency or threat is created
This is the most commonly used psychological trick. Emails threatening that your account will be closed, that you owe money, or that you must act “immediately” are designed to make you panic and act on impulse, without thinking.
4. Suspicious links
Always check where a link leads before you click. On a computer, simply hover your mouse cursor over it and the real address will appear in the bottom corner of the browser. If the link text says bank.bg but the real address leads to bit.ly/random or bankpromo.xyz, it's a scam.
5. Unexpected or strange attachments
Never open attachments you aren't expecting, especially ones with extensions such as .exe, .zip, .scr, or even .html. They often contain viruses that can infect your device.
6. The offer is too good to be true
If you get a message saying you've won a lottery you never entered, or you're offered a product at an absurdly low price, it's almost certainly a scam.
7. Spelling mistakes and poor design
Large companies have teams that take care of their communications. Emails full of grammatical or spelling errors, or ones with blurry logos and sloppy design, are a clear sign of a scam.
8. Requests for sensitive information
No legitimate institution (a bank, a government agency, a social network) will ever ask you to send your password, PIN, credit card number, or EGN, the Bulgarian personal identification number, by email.
9. Content that doesn't add up
You get an email from a courier company about a parcel you aren't expecting? Or a notification from Netflix that there's a problem with your payment, when you don't even have a subscription? Mismatches like these are a sure sign of phishing.
10. The message is completely unexpected
If you get a password-reset email you didn't request, or an order confirmation for something you never ordered, simply ignore it and delete it.
How do we protect ourselves?
4 key recommendations for everyone
Here are four basic steps anyone can take to protect themselves from a phishing attack.
1. Be more curious and more suspicious
The most powerful weapon against phishing is critical thinking. Before you click any link at all, take 10 seconds to ask yourself the following questions:
Who is the sender?
Look at the whole email address, not just the name. Scammers often use addresses that merely resemble the official ones (e.g., [email protected] instead of [email protected]).
Is there anything unusual?
Unexpected offers, surprising messages about account problems, or spelling and grammar mistakes are a clear red flag.
Where does this link really lead?
Hover your mouse cursor over the link (without clicking!) and look at the address that appears in the bottom corner of the browser. If it looks odd or has nothing to do with the company, don't open it.
Are they pressuring you to act “right now”?
Scammers count on impulsive reactions. Phrases like “Last chance!”, “Your account will be deleted!” or “Today only!” are meant to stop you from thinking clearly.
2. Report it! Don't just delete it
When you simply delete a suspicious email, you solve the problem only for yourself. When you report it, you help everyone else.
Every email client (Gmail, Abv—a popular Bulgarian email service—Outlook, and others) has an easy-to-use “Report spam” or “Report phishing” button. Using it sends a signal to the service provider, which can block the sender and protect thousands of other users from the same scam.
When you come across a suspicious email, your first reaction may be just to delete it. But if you take a second to report it, you go from potential victim to an active part of everyone's defense.
When you report phishing, you:
- Protect thousands of other people. Every report is a signal for email service providers (Gmail, Abv, Outlook, and others). Their filters learn from these signals, and the next time the same email is sent to another user, there's a much better chance it will land automatically in the spam folder or be blocked entirely.
- Help take down fake websites. Reports are also analyzed by cybersecurity companies and hosting providers. Once enough signals pile up, the fake site the link leads to can be taken down much faster. That way you actively help remove the “trap” before others fall into it.
- Improve your own protection. When you mark a certain type of message as malicious, you help your own email filter get smarter and protect you more effectively in the future.
3. Trust the technology you already use
The good news is that the big email providers have already put powerful protections in place. Their filters automatically stop a huge percentage of malicious messages. They also use sophisticated technologies (such as SPF, DKIM, and DMARC) that check whether an email really comes from the sender it claims to be from. To take advantage of these protections:
- Use an established, modern email provider.
- Keep your web browser and antivirus software regularly updated.
4. Understand the value of simulations
Running simulations regularly is one of the most effective training methods, both for large companies and for society as a whole. They help us stay alert and turn knowledge into a practical habit. Don't be surprised if, for example, your employer sends you an email to test whether you'd fall for an attack like this. The idea is that next time you'll stop and think. And we all win from that.
Nothing complicated? Exactly—at least after Viktor's thorough guidance. And if even one person stays safe after reading this text and thinking it over, then it's definitely worth carrying on.
As for whether it's needed—there's no question, as will become clear shortly after New Year's, when we'll tell you about the experiment we ran together with Viktor and his colleagues.
Until then: happy… and wise holidays!
