An SMS from "EuroBankEFG" warns that your card will be deactivated after 21/10/2026 23:59 without a "security update". It is a scam: the shortened link leads to a Spanish website. How to recognise it and what to do.

On 23/9 Skroutz Last Mile disclosed unauthorised access to a shipment system: names, addresses and phone numbers were exposed, not cards. That data makes fake courier SMS far more convincing. What to expect and which domains are official.

Thousands of fake airline "Support" accounts watch public complaints on X, Facebook and Instagram, reply with the logo, move the chat to WhatsApp and "approve" a $500 compensation that needs your card number to "complete". Check Point research, 16 Sept 2026. The rule: to pay you, nobody needs your card.

The first Google result was an ad. It led to a "shared file" with malware the antivirus missed. Two weeks later the attackers had opened projects in the victim's Google Cloud and burned €87,000 on Gemini. Google wrote off €65,000 and is chasing €22,000 through a collection agency.

They call as the electricity company, ask for your child's number "to confirm", record their voice and play it back to you cloned. Six cases, two arrests, over €1M. What to agree with your family today.

For months the attackers posed as an Italian authority from a genuine government email and Revolut sent them customer data. Now they demand a $3M ransom. Your money is safe, the follow-on scams are not.

Two public bodies in Crete lost a combined €652,000 in two hits using the same method, a Greek shipping company lost (and recovered) €4m in a BEC attack, and the creator of Have I Been Pwned publicly admitted falling for phishing himself. This guide explains why the target is never your ignorance, but your bad moment — and which rule actually protects you.

A page that looked like the bank, the authority's credentials typed into it, and within three hours 55 small transfers moved 152,000 euro abroad. We explain in plain language what smurfing is, why fraudsters split the amount into dozens of pieces, why they strike in the middle of the night, and the single rule that defeats the whole attack.

Attackers no longer break the one-time code — they walk around it, stealing your browser's temporary entry wristband after you sign in normally. We explain in plain words how it works, why the fake page looks flawless, and why passkeys stop it without you having to spot anything.

A text claims your Apple account was "verified elsewhere" and offers a link. The link goes to appale-cy.cc — appale, not apple. We detected it on 17 July 2026 from real user submissions, and Cyprus Police warned about the same tactic on 25 July.