Fake emails “from the NRA”: how to spot them
Published
Emails in the name of Bulgaria's National Revenue Agency (НАП / NRA) that threaten a seizure or promise a tax refund arrive in waves, and the agency has warned about them many times. Here is what the NRA itself says: what it never does, how to recognise a fake, and what to do if you've already clicked.
What the NRA never does
In its anti-phishing advice the NRA states that it never asks clients for information through messages or emails: whatever data it would need, it already has. An email “from the NRA” asking for a password, a card number, your EGN or to “confirm your profile” is a scam.
Signs of a fake
- Urgency in the subject or text (“Important”, “Urgent”, a deadline of a few hours) so you act without thinking.
- A request to “confirm” or “update” a registration or profile through a link.
- A link that looks like the NRA's but leads elsewhere. Hover over it (or long-press on a phone) and read the real address. According to the NRA it should end in nra.bg or nap.bg and start with https://.
- An attachment with “details” or a form to fill in.
- A lure such as a refund of overpaid tax.
The NRA has warned, for example, about emails from a “chief public enforcement agent” announcing an “electronic seizure” and urging recipients to open an attachment with bank accounts. The sender's address closely resembles an agency address, but the domain is different.
If you received one
- Don't open the links or attachments. Delete the email.
- Don't enter personal or bank details.
- If you're unsure whether a message is genuine, go to portal.nra.bg yourself by typing the address, or call the NRA information centre (0700 18 700). Don't use phone numbers or links from the email itself.
If you already clicked or entered data
- From another, trusted device, change the password you entered, and everywhere else you use the same one.
- If you entered card details, call your bank right away.
- Scan your computer with antivirus software, especially if you opened an attachment. Get help from an IT specialist if needed.
The same pattern with couriers
Emails and texts about a “held parcel”, an “unpaid fee” or a “wrong address” in the name of courier companies follow the same pattern: urgency, a link and a request for card details. The rule is the same. Check a shipment only in the courier's official website or app, opened by you, not through the link in the message.
One way to get less of this mail is not to give your personal address to every site. For one-off sign-ups a temporary email does the job, and your real address doesn't end up in databases that later leak.