Hundreds of thousands of leva have been stolen from Bulgarian bank accounts online over the past few years, Bulgarian news agency BTA quoted an Interior Ministry annoucement as saying on October 19 2009.

Police could not give an exact count on the number of bank accounts hit by hackers, the websites or the exact amount of money stolen, because many of the victims had not yet noticed the missing money or have not called the police, BTA said.

There were several ways for hackers to drain money from people's bank accounts online, police said and asked people to be careful when shopping online.

One of the most common schemes, police said, was the so-called fishing method, where a hacker use a computer programme to send emails to a list of randomly generated e-mail addresses, "informing" the client that there is a problem with his or her online bank account.

The victim is then asked to send a reply to the "alert" and to specify his or her user name and password.

Experts advice not to open such emails, even though their emails addresses in many case are very similar to those used by genuine companies and banks.

Another way used to gain access to people's money, police said, was by sending emails in which the victim was asked to call a specified telephone number in order to confirm their personal data.

Another method to gain access to bank accounts which does not use email, police said, was the "farming" method, which uses fake website that resemble real bank websites. Hackers re-direct unsuspecting victims to the fake websites. When users then log in to what they think is their bank account, they effectively hand over all login data to the hackers.

A more complicated method used to steel money from people's online banking, according to the police, was the use of so-called "human proxies," where people from IT support companies are used to deliberately infect PCs with certain viruses, often simply via a USB memory device.

Besides using legal copies of software and up-to-date anti-virus programmes, experts advice was to use universal electronic signatures or a so-called virtual credit card for online payments, BTA said.

Since the beginning of 2009, Sofia prosecutors had started eight pre-trial investigations in computer scams, BTA said.

Any website that stores and operates with consumer data, must be registered with the Commission for Personal Data Protection. However, the commission only registers applicants, it does not have the right license websites.

So far the commission has not received any tip offs concerning abuse of personal data by Bulgarian websites.

On a global scale things were more challenging as most websites registered abroad did not comply with Bulgarian legislation, police said.