Payments Fraud in Bulgaria 2026: Euro Adoption, Card Fraud and the Instant-Payment Trap
Bulgaria entered the euro area in January 2026 while its payment systems were accelerating toward instant transfers. The fraud picture is less straightforward. Cards dominate reported fraudulent transactions, but transfers carry much larger losses per incident. A wave of bank impersonation and changed-beneficiary scams is testing whether businesses can verify the destination of money before it moves.
Bulgaria's Payment Market: A Rapidly Digitalizing System Changes Currency
The euro conversion was not simply a new symbol on prices. It altered the currency of deposits and settlements while domestic card and transfer infrastructure was already handling higher payment volumes.
On 1 January 2026, Bulgaria became the 21st member of the euro area, using the irrevocable conversion rate BGN 1.95583 to €1. The lev and euro circulated together for January, but from 1 February the euro became the only legal-tender currency. Existing lev-denominated bank accounts were converted automatically. The Bulgarian National Bank still exchanges lev cash without a deadline or fee, eliminating the need for a stranger to arrange a special "conversion account".
The national infrastructure operator BORICA recorded 57.2 million card transactions passing through its systems in December 2025, an 11% increase over December 2024, worth approximately €3.4 billion. This is an operator-specific monthly processing count, not a survey of how every Bulgarian consumer paid, and not the same universe as the ECB's issuer-side annual card totals.
At the household level, the National Statistical Institute's 2025 survey found that 86.5% of people aged 16–74 used the internet regularly and 51.2% purchased goods or services online. The shift extends exposure to fraudulent stores, impersonation messages and false invoices, though internet participation itself is not a measure of victimization.
Bulgaria's indigenous transfer infrastructure matters as much as international card schemes. BORICA's BISERA system and blink brand have given consumers and businesses increasingly familiar instant transfers, including payments initiated with a mobile-phone number. The ECB confirmed Bulgaria's full TARGET-services onboarding in January 2026, linking the country's financial plumbing more tightly to euro-area settlement.
For merchants, cards, instant transfers, conventional bank transfers and cash should be analyzed separately. Each comes with different evidence at checkout, authorization rules, refund possibilities and options for interrupting a suspicious payment before the funds are gone.
The Payment Transition
Selected documented measuresBulgarian residents aged 16–74, 2025; weekly or more frequently.
People aged 16–74 purchasing goods or services online in 2025, not a share of payment transactions.
Transactions handled by BORICA's card systems during that month, up 11% year on year.
Final official conversion rate. Lev bank accounts converted automatically on 1 January 2026.
These indicators have different denominators. They are presented side by side, not added together as one national "cashless share".
See the NSI household survey, BORICA's December processing figures and the ECB changeover announcement.
Payment Fraud in Bulgaria: Many Card Incidents, Larger Individual Transfer Losses
The joint European supervisory dataset reveals an asymmetry that aggregate fraud totals conceal. It is possible for the rail producing fewer fraudulent transactions to account for more fraudulent value.
Share Across Cards and Credit Transfers
| Instrument | Events | Fraud value |
|---|---|---|
| Cards | 82,039 | €4.736m |
| Credit transfers | 1,769 | €5.559m |
Shares are calculated only within these two payment instruments. They exclude e-money, cash withdrawals and direct debits; the figures are not a complete national fraud total.
The ECB/EBA country tables give these 2024 payment counts and values.
In the ECB–EBA's December 2025 report, Bulgarian card issuers recorded 82,039 fraudulent card payments worth €4.736 million in 2024. The equivalent credit-transfer count was just 1,769 transactions, yet those transfers were worth €5.559 million.
That places cards at approximately 98% of reported fraud events across the two rails but only 46% of their fraudulent value. The average reported fraudulent card transaction was about €58, whereas the average fraudulent transfer was roughly €3,143—more than 50 times higher. EU/EEA averages were €76 for cards and €2,155 for transfers. These averages describe the fraudulent transactions captured in the reporting system, not the net amount eventually unrecovered by a customer.
Fraud-rate comparisons have different denominators again. Card fraud represented 0.023% of the value of all reported card payments, below the EU/EEA total of 0.033% (by count, 0.014% against 0.015%), while credit-transfer fraud represented 0.001% of credit-transfer value. Transfers move substantially larger legitimate sums, so a much lower rate can coexist with greater harm per fraudulent incident.
Importantly, the report explicitly marks the Bulgaria credit-transfer value and rate as revised figures included exceptionally for its country table. The underlying report excludes Bulgaria's H2 2024 credit-transfer data from some aggregate EEA charts. This is why the national tables, rather than an extrapolation from an EEA-wide chart, form the basis of this illustration. One limit follows: Table 2 does not flag the 1,769 transfer count as revised, so the €3,143 average divides a revised value by a count that may still carry the H2 2024 data issue. Treat that average, the 54% value share and the “more than 50 times” comparison as indicative rather than precise.
The same report shows who absorbs transfer losses. Across the EU/EEA, payment-service users bore around 85% of credit-transfer fraud losses in 2024, and Bulgaria is among the countries where the users’ share exceeded 80%.
Do not mistake fraud value for criminal proceeds retained after recovery, reimbursement or law-enforcement action. The distinction matters when discussing consumer responsibility, bank exposure and merchant losses. The same precision applies to the 2025 industry fraud figures discussed below: later incident and police series cannot be added to this 2024 ECB dataset.
From Euro-Conversion Scams to Faster Transfers: The 2025–2026 Fraud Shift
Two developments occurred together: instant transfers grew quickly, and the country encountered scams that explicitly exploited the coming euro changeover. This does not prove one caused the other—but it alters the preventive control priorities.
BORICA's 2025 payment-system results, released in January 2026, show approximately 38.2 million instant transfers, an increase of 69%. Their total value reached €35.3 billion, up 87%. Instant payments represented 27% of the operator's transfer count, up from 18% a year earlier. BORICA's mobile-number blink person-to-person service alone processed 2.7 million payments worth €424 million in 2025; that narrower product series should not be confused with all instant payments.
A separate criminal method exploited the euro's introduction before it happened. In August 2025, Bulgarian organized-crime police disclosed what it called the first euro-related cyber fraud. Scammers contacted a victim through an encrypted messaging app, using a profile bearing the logo of the payment platform the victim used, and warned that the balance would be lost unless it was moved to a “service account.” The victim made several payments, and around BGN 10,000 was redirected to cryptocurrency platforms, other online payment services and utility bills; investigators expected to recover part of it. This was a reported individual case, not a measure of national scam losses.
The July 2026 BORICA fraud-prevention forum cited organized-crime police figures of €13 million in 2025 IBAN-substitution fraud. It also referred to 24,755 card-fraud cases over one year and 1,757 online-fraud reports to the Ministry of Interior. The forum did not provide a fully harmonized denominator or reporting method for every count, so these figures are signals from different sources, not the components of a verified all-in fraud total.
Separately, the Interior Ministry's 2025 annual report showed that telephone-fraud cases rose from 282 in 2024 to 386 in 2025, an increase of 36.9%, despite total recorded crime falling 6.6%. Phone fraud is defined and recorded differently from ECB fraudulent-payment transactions, and the two counts cannot be combined.
The 2026 lesson is not that euro membership created crime. The plausible mechanism is more specific: conversion notices and new settlement routines created credible narratives for impostors, while fast account payments reduce the time available to detect and challenge an altered beneficiary.
Chronology of the Shift
Payments and fraud · separate measures82,039 fraudulent cards and 1,769 fraudulent credit transfers, ECB/EBA issuer and payer-PSP reporting.
38.2 million transfers valued at €35.3 billion, by BORICA's operator series.
Police detail a false “service account” instruction sent through a messaging app, showing how changeover anxiety can be exploited.
Bank accounts converted automatically at the irrevocable 1.95583 lev/euro rate.
BORICA cites €13 million of 2025 fraud involving bank-account identifier changes.
A chronological presentation is not a causal estimate. Source populations, classifications and time windows differ.
Who Encounters Fraud? Distinguishing Actual Victimization from Digital Participation
Available age data are much stronger at the European fraud-outcome level than for Bulgaria's national monetary losses. Presenting the two as though they were the same would produce a false picture of vulnerability.
The EU Agency for Fundamental Rights' May 2026 online-fraud study surveyed 26,453 people across the EU, asking whether they had ever been deceived through an email or instant message into transferring money, paying for something or supplying personal data. Across all EU countries, 24% of respondents reported at least one such experience. The measure includes surrendering personal data, not just financial loss.
Crucially, these are EU-wide outcome rates, not Bulgaria-specific age rates. The study reports approximately 30% for ages 25–39 and 19% among people aged 55 and older. Some of the gap reflects differences in use of email and messaging services. These figures cannot legitimately be relabeled "Bulgarian fraud victims by age" or "share of Bulgarians who lost money".
Bulgaria's own 2025 NSI survey provides digital exposure context rather than fraud outcomes. Regular internet usage was 98.2% among 16–24-year-olds and 96.9% among 25–34-year-olds, compared with 59.7% among those aged 65–74. Internet shopping was highest among people aged 25–34, at 70.8%, and lowest among ages 65–74, at 17.7%.
The result is a two-sided caution. Younger groups have higher contact with online shopping and messages, while older adults remain reachable through phone impersonation and familiar authority narratives. Neither observation demonstrates a higher conditional fraud-loss rate for a Bulgarian age group.
Our source review did not establish a reliable public table of Bulgaria-specific monetary-loss or victimization rates normalized by age. Instead of filling that gap with invented percentages, the charts explicitly identify the geographic scope and outcome they measure.
Online Fraud Experience by Age
EU-27 only · FRA 2026 · ever deceived online. These are actual fraud-experience outcomes, not Bulgarian estimates or exclusively monetary losses.
Bar scale 0–50%. The FRA online-fraud survey covers the EU; these bars are not a Bulgaria age tabulation.
Bulgarian Digital Reach by Age
Bulgaria · NSI 2025 · regular internet use. Not an age-specific fraud metric.
Bar scale 0–100%; internet access is a channel-exposure measure. No national fraud-risk ranking can be inferred from this chart.
Fraud demographics are useful only when the numerator is fraud and the denominator is the relevant population. Bulgaria's national age-specific financial-loss rates are an acknowledged evidence gap, not an invitation to substitute internet-use figures.
How Payment Fraud Works in Bulgaria: Card Theft, False Bank Staff and Redirected Accounts
The tactics differ in technology, but the common thread is borrowed authority: a familiar merchant, bank, colleague or public institution appears to instruct an urgent payment.
Stolen Credentials at Remote Checkout
Attackers obtain card details or account access through fraudulent stores, breached services and deceptive payment pages. The national ECB/EBA count is high for cards, but its country table does not alone establish what share was e-commerce, in-store or cross-border. Remote-card controls are therefore warranted without inventing a Bulgaria-specific channel split.
Impersonated Currency-Conversion Support
Scammers may claim an account balance will be lost unless it is moved to a "conversion" or "service" account, often posing as a bank or payment platform through a messaging app. Bulgarian police documented such a case in 2025. Because legitimate lev account balances converted automatically at the official rate, the requested movement of money was itself a warning sign.
IBAN Substitution and Business Email Compromise
An attacker alters the beneficiary details on an invoice or sends a convincing replacement payment instruction. The financial controller may be genuine, the purchase legitimate and the transfer authorized—but the destination fraudulent. BORICA cited €13 million in 2025 IBAN-substitution fraud using organized-crime police information.
Urgent Calls and Fake Banking-Security Teams
Impostors claiming to represent banks create an immediate problem with a card or payment. United Bulgarian Bank warned in May 2026 about rising fake bank calls and emails asking customers to disclose credentials or install remote-access software.
Faster Authorized Transfers to False Beneficiaries
In a manipulated-payer attack, real customer authentication is not enough: the scammer convinces the legitimate user to send money to an account of the scammer's choosing. Bulgaria's instant-transfer scale makes beneficiary verification and immediate anomaly response more important, although growth of instant transfers alone does not prove a matching rise in fraud.
These mechanisms are documented by the ECB/EBA report, Bulgarian police, UBB's warning and BORICA's forum.
Bulgaria's New Settlement Rules: Verification of Payee Still Has a Transition Window
Being in the euro area does not mean every operational requirement was automatically delivered by every provider on the day the country adopted the currency. The published Bulgarian implementation schedule must be read independently.
Strong Authentication
Apply PSD2 strong customer authentication and risk-based 3-D Secure screening to relevant transactions; monitor exemptions and unusual remote activity.
Beneficiary Checks
Match recipient name to IBAN where verification is available, but maintain independent controls for supplier-account changes even when a match appears.
Instant Reconciliation
Verify receiving bank status and transaction references directly, not screenshots or customer claims of payment.
Escalation and Evidence
Contact the bank immediately on suspected transfer fraud, preserve invoices, message headers, callback notes and account changes.
Regulation (EU) 2024/886 establishes the European framework for instant euro transfers, including sending and receiving services, pricing safeguards and verification of payee. The general schedule differs between euro-area and non-euro-area countries. Since Bulgaria entered the euro only in January 2026, assuming that the earlier 2025 euro-area deadline applies without transition would be misleading.
At a payments conference in October 2025, the Bulgarian National Bank's payments-supervision director said Bulgaria had until 1 January 2027 to implement the instant-payment requirements after euro adoption. United Bulgarian Bank's July 2026 guidance likewise identifies 1 January 2027 for Bulgarian banks' verification-of-payee service, describing a real-time comparison of the named beneficiary and the account's IBAN on both ordinary and instant SEPA euro transfers. In February 2026, the Association of Banks in Bulgaria said banks were 99% ready, with verification of payee the only functionality still to be fully implemented.
This is a concrete regulatory timeline, not an assurance that every service will operate identically at every bank. Businesses should verify current availability, rejection/warning behavior and exception handling with their financial institutions. Until then, a standard operational control remains valuable: treat every unexpected supplier-bank change as a separately verified high-risk event.
The ECB's published changeover timetable is equally relevant to fraud prevention. Bulgaria's dual-price display period ended in August 2026; the central bank's free, indefinite lev cash exchange continues. A merchant receiving messages from an alleged exchange agent must not infer legitimacy from the sender's claim of official currency assistance.
BORICA's new infrastructure and the Eurosystem's TARGET integration increase service reach and speed. The appropriate policy response is not to reject instant payments, but to improve payee-master governance, approval segregation, automated settlement confirmation and escalation when payment details are altered.
Key Control Milestones
Verified country-specific timelineBORICA says SEPA instant euro capability became available through BISERA/TIPS in December 2024.
National bank joins the euro-area central-bank infrastructure, with account conversion at the fixed rate.
End of month-long dual cash circulation; the BNB continues to exchange lev indefinitely.
Identified in October 2025 BNB official comments and July 2026 UBB guidance; individual-bank details still matter.
Official requirements depend on institution type, applicable provisions and transition rules. The timeline is not individualized legal advice.
Fraud Controls for Bulgarian Merchants: Stop the Redirect Before the Payment
The priorities change with the rail and business model. Fraud screening for ecommerce orders is not a substitute for controls over supplier banking details, nor does an instant-payment confirmation prove that a beneficiary was authorized.
Physical Retail and Tourism
Priority: Use compliant terminals, properly reconciled euro pricing, clear receipts and refund procedures. Train staff to recognize requests for unofficial currency exchange and protect customers from misleading terminal instructions.
Online Card Merchants
Priority: Combine 3-D Secure 2 with behavioral, velocity and device signals; confirm fulfillment, provide clear refund terms and establish a consistent chargeback response process. Distinguish stolen-card transactions from buyer disputes.
Supplier and Contractor Payments
Priority: Freeze any invoice or beneficiary update until a second staff member has confirmed the change via a number independently obtained from existing supplier records. Maintain timestamped evidence of the verification.
Instant Transfer and blink
Priority: Integrate direct settlement-status and reference validation; match amount, order and receiving account before releasing digital goods or high-value products. Never rely only on a screenshot sent through a messaging app.
Cross-Border and Euro Accounts
Priority: Audit IBAN master data, currency conversion logic, refund account controls and settlement reporting. Payee checks can reduce mistyped or spoofed beneficiaries, but should not override independent business verification.
Higher-Risk or Recurring Sales
Priority: Document actual sales volumes, recurring billing, refund periods, shipment or fulfillment timing, prior disputes and cross-border exposure when pursuing high-risk merchant account approval. Controls should follow the transaction lifecycle.
A forged invoice can defeat the best checkout authentication: the buyer is genuine, the funds are real and the recipient is wrong. Bulgaria's most urgent control belongs before the beneficiary is approved.
Secure Payment Processing for Bulgarian and Cross-Border Merchants
Payment risk depends on how customers pay, where the business operates, what it sells, when it fulfills orders and its history of refunds and chargebacks. Durango Merchant Services helps evaluate these details, identify underwriting concerns and prepare the documentation and safeguards required to secure processing.