The new phishing scam that uses your name to trick you

A sophisticated new phishing campaign is circulating. Scammers no longer use generic greetings; they're now using your name to gain your trust and steal your information. We explain, without beating around the bush, how to spot this and other scams so you don't fall for them.

Cybercriminals are constantly refining their methods, and the latest security warning focuses on an evolution of phishing that makes it more dangerous and difficult to detect. Unlike fraudulent emails of the past, which were often given away by generic greetings like "Dear Customer," the new campaigns use personalization to deceive their victims, addressing them by their real names.

This simple change dramatically increases the credibility of the message, making the user less guarded and more likely to click on malicious links or download infected attachments.

Although attacks are becoming more sophisticated, most phishing attempts still exhibit one or more of these warning signs. Learning to recognize them is the first line of defense in protecting your personal and financial information:

• * Poor Spelling and Grammar: Despite improvements, many fraudulent emails still contain obvious errors. Legitimate companies usually have review processes to prevent these errors.
• * False Sense of Urgency: Messages demanding immediate action (“Your account will be locked in 24 hours,” “Click here to claim your prize now”) are a classic tactic to get you to act without thinking.
• * Links to Strange Websites: Before clicking, always hover over the link (or long-press on mobile) to see the actual URL. If the address that appears is different or suspicious, it's a scam.
• * Unexpected Attachments: Never open an attachment you weren't expecting, even if it appears to be from a known contact. It could be a virus. If in doubt, contact the sender by another means (a call or text message) to confirm that they sent it.
• * Requests for Confidential Information: No legitimate company or bank will ever ask you for your password, full credit card number, social security number, or other sensitive information via email.
• * Unknown or Suspicious Sender: Pay attention to the sender's email address. Scammers often use domains that mimic real companies, but with slight variations.
• * Lack of Personalization (Despite Everything): Even if they use your name, they often leave out other details. A real bank, for example, will often include the last digits of your account number to verify its legitimacy.
• * Sender Impersonates an Authority: Be wary if a supposed representative of a company or government entity asks you for information they should already have.
• * Hidden or Blank Recipients: If the “To:” field says “undisclosed recipient list” or is empty, it is a sign that the email was sent in bulk and is likely a phishing attempt.

The golden rule is: when in doubt, do nothing. Don't reply to the message, don't click on any links, and don't download any files.

• * Verify by another means: If the email appears to be from a company you have a relationship with (your bank, a streaming service, etc.), don't use the contact information in the email. Find the company's phone number or official website yourself and contact them directly to verify the message's legitimacy.
• * Delete the message: Once you confirm your suspicion, delete the email to avoid accidental clicks in the future.
• * Report fraud: Many entities, such as the Spanish Tax Agency, have specific channels for citizens to report these fraud attempts, which helps alert other users.

"We're all targets, both at work and at home, because cybercriminals can make a lot of money from our information and our devices."

Cybersecurity isn't just a matter of technology, it's also a matter of habits. Staying informed and skeptical is the most powerful tool against digital fraud.