Most ecards are safe to open. A card from someone you know, sent through a site you recognize, is a web page with a video on it. The ones to watch for are fakes: emails dressed up as a card so you'll click a link, download something or type in a password, and you can usually catch them in under a minute.
We make video cards, so we have a personal interest in you not getting tricked by a bad one. Here's that minute, and then what a real card looks like. Spoiler: it's your dad in a boy band.
Who sent it?
Start with the name. A real card comes from a real person, and it says who they are. A message announcing that "someone" sent you a greeting, with no name attached, is how a stranger talks, not your aunt. Then look at the actual email address, not just the display name, because anybody can type any display name. Including your aunt's. Your aunt's real address is probably not nine random numbers at a domain you've never heard of.
If the name checks out but the timing is odd, like a card in March from someone who only does Christmas, text them and ask if they sent it. It takes five seconds.
Where does the link go?
On a computer, rest your mouse on the button without clicking, and the real address shows up, usually in a bottom corner of the window. On a phone, press and hold the link to preview it. Read the domain, the bit right before the .com. If the email says it's from one company and the link goes to some other name, or to a near-miss spelling of a name you know, close it. One wrong letter is all it takes, and they're counting on you reading fast.
What does it want from you?
This is the big one. A real ecard plays in your browser, and that's all it does. It doesn't need you to download a "player," open a zip file, install an app, or sign in with your email password. If a card asks for your password, it isn't a card. It's a login form wearing a party hat.
Same goes for pressure. A countdown, a warning that the card will be deleted, a scary note about your account. Greeting cards aren't urgent. Nobody's birthday wish self-destructs.
Why December needs extra care
Around Christmas, lots of people send cards, so a message saying someone sent you a Christmas video card doesn't look strange. That's what lets a fake one blend in. The checks don't change in December. You just have to actually do them, somewhere between wrapping presents and pretending to like fruitcake.
If you already clicked
Close the tab. If you typed a password into anything, go to the real site yourself by typing the address (not by using the link), change the password, and turn on two-step sign-in while you're there. If you downloaded and opened a file, run a security scan on that device. Then hit your email's "report phishing" or "report spam" button so it gets flagged. That's it. Nobody needs to throw a laptop in a lake.
What a real Tangy Limes card looks like
Here's ours, so you know what normal looks like, and because it's more fun than a phishing email. A Tangy Limes card is a short music video where somebody's real face, cut out of a photo, dances and sings an original song, mouth moving to every word. Picture your whole family as a late-90s boy band in matching outfits, fake snow falling, lasers cutting through the fog, and your dad very committed to the choreography. That's a real card.
It reaches you one of three ways: a video file a friend texted you, a share link, or an email sent from the card page with the sender's name right in the subject line. Links open a plain page at tangylimes.com/c/ that plays the video. Nothing to install, no account, no sign-in. The video starts with an intro showing who it's to and who it's from, so you see familiar names before anyone dances. If it's your own face singing, that's not a hack. That's your cousin, who found a photo of you.
Want to be the one sending the safe, ridiculous card this year? Pick a card, upload a family photo, type the names and press play. The preview with everyone's faces in it is free, and watching your own relatives sing a song they've never heard is a strong argument for sending it. Keep it for $1.99, no subscription. Then text the person to say it's coming, which is polite, and it gets them through the first check.