The email “from AADE” that isn’t from AADE: how to spot phishing

Before and now

Scams used to arrive as a phone call from some “tax office employee”, or as a letter full of spelling mistakes. They were fairly easy to spot.

Today they arrive by email or on your phone, and they look very much like the real thing: logo, colours, even your name. In February 2026, for example, AADE itself warned about text messages from senders named “MYaade” or “GOV”, asking people to pay a supposedly unpaid road tax through a link.

This is not rare. ENISA, the EU’s cybersecurity agency, found that phishing was the way in for 60% of the attacks it studied. And in Cyprus it was the most common attack reported by businesses in a survey by the Digital Security Authority.

What phishing is, and its “relatives”

• Phishing (from “fishing”): a fake email that wants you to click a link and hand over passwords, card details or money.
• Smishing: the same, by text message. For example: “Your parcel is being held, pay the customs fee here.”
• Vishing: the same, by phone. Someone says they work for your bank or the tax office and asks you for a code that has just arrived on your phone.

The goal is always the same: to rush you, so you don’t have time to think.

The 30-second test

Next time you see a message like this, before you tap anything:

1. Who sent it. Don’t look at the name, look at the address. Anyone can write the name “AADE”. AADE points out that fake addresses often look like the real ones, with one letter changed or added.
2. Is it in a hurry? “Within 24 hours”, “or you will be fined”, “final notice”. Urgency is the most common sign.
3. What it asks for. Passwords, card details or a payment through a link.
4. Where the link goes. On a phone, press and hold it. On a computer, hover the mouse over it without clicking. And don’t be reassured by the padlock or the “https”: the fake sites in AADE’s example had those too.
5. Were you expecting it? If you aren’t waiting for a refund or a parcel, why would one be coming?

If you already clicked

It happens to careful people too. What counts is moving quickly:

1. If you gave card details or e-banking passwords, phone your bank right away.
2. If you gave other passwords, change them right away, from another device you know is safe. First on the account they asked about, then on any other that uses the same password. For TAXISnet you can also call AADE on 1521.
3. Keep the message. Don’t delete it yet: you’ll need it for the report.
4. Report it. In Greece, to the Cyber Crime Division on 11188 (24 hours a day, free of charge) or at ccu@cybercrimeunit.gov.gr. In Cyprus, to the police cybercrime office on 22808200 or at cybercrime@police.gov.cy.
5. Tell your team. The same message has usually reached others too.

Four measures that protect you from tomorrow

1. Two-step verification (2FA). Along with your password, it asks for a confirmation from your phone. So even if someone learns your password, they can’t get in. According to Microsoft, it can stop more than 99% of attacks on accounts. Turn it on for your email, your bank and your social media.
2. Never log in from a link. For AADE, your bank and your email, type the address yourself or open it from your bookmarks.
3. Updates. Phone, computer and browser on their latest version.
4. One rule for the team. “Before we pay anything that came by email or text message, we make a phone call to confirm it.” A phone call costs far less than a scam.

Is it hard?

No. Most of this you set up once, in an afternoon, and the 30-second test becomes a habit within a few days. And when you’re unsure about a message, the safest thing is to do nothing and ask.

If you found this useful, send it to whoever makes the payments in your company.