How to recognise fake emails from the NRA, Econt or Speedy

Signs of phishing emails sent in the name of the Bulgarian tax agency and courier companies, how to check the sender and what to do if the link has already been opened.

OfSec 2 min read

Fake emails in the name of the National Revenue Agency (NRA), Econt, Speedy and other well-known organisations are among the most common scams in Bulgaria. They aim to get the recipient to open a link, enter card details or download a file containing malware. In companies, such emails are often the first step towards a more serious incident.

Typical scenarios

  • "Your parcel cannot be delivered. Pay a surcharge of €1.50." The amount is small so that it does not raise suspicion.
  • "You have an unpaid liability to the NRA. Pay within 24 hours to avoid a garnishment."
  • "You have overpaid tax. Enter your card details to receive the refund."
  • An invoice or waybill attached as a file with the extension .zip, .html, .iso or .exe.

Checking the sender

The sender's display name can be anything, so check the address after the @ sign. The official domains are nra.bg for the NRA, econt.com for Econt and speedy.bg for Speedy. Fake addresses resemble the official ones but contain extra words, hyphens or a different ending.

  • Hover over the link without clicking and check the real address.
  • Open the email headers ("Show original" in Gmail, "View message details" in Outlook) and look for the Authentication-Results line. A fail result for SPF, DKIM or DMARC is a strong sign of a fake.

A safe way to check

Do not use the links in the email. If in doubt, type the address of the NRA e-services portal yourself or open the courier's app and look up the parcel by its number. A genuine liability or parcel will be visible there as well.

  • If you entered card details, call your bank immediately and block the card.
  • If you entered a password, change it from another device in every service where it is used.
  • If you opened an attachment, disconnect the device from the network and contact an IT specialist.
  • Do not delete the email. Forward it as an attachment to the person responsible for IT: the original is needed for the analysis.

Protecting the company

A short training session for staff with examples of real emails reduces the number of clicks. Correctly configured SPF, DKIM and DMARC records for the company domain prevent fraudsters from sending emails to your customers in your name.

PhishingBusiness email