Recognising a scam

A tearful voice on the phone introduces itself as a grandson or a daughter and describes an accident, an arrest or a medical emergency. A third person then takes over, claiming to be a police officer, a lawyer or a doctor, and demands an immediate sum for bail or hospital fees. The shock is such that the victim does not think to check. They are asked to hand the money to an intermediary who comes to collect it, or to transfer it on the spot.

The relative, in tears, is hard to recognise, and the caller insists that no one else in the family be told. Voice deepfakes make these calls even more convincing, as the imitated voice can sound like the real relative's.

The call comes from someone claiming to work for your bank, who mentions a suspicious transaction or a compromised card and offers to put the account out of harm's way. The tone is professional and reassuring, although the caller urges you to act quickly for the sake of security. You are asked for your PIN and then told that a courier will call round to collect the card so that it can be destroyed or replaced. Once the card and the PIN are in their hands, the fraudsters empty the account.

In May 2024, French and Swiss police announced twelve arrests in a network of fake bank advisers suspected of deceiving nearly 400 people. In May 2026, the Vaud cantonal police arrested nine people aged 18 to 27 in the Lausanne area in the course of an investigation into fake bank adviser fraud. The police statement describes a supposed bank employee who invokes an urgent online banking update or a suspicious transaction, then obtains a transfer to an account presented as secure or takes remote control of the computer.

According to Blick, 23 May 2024 and Vaud cantonal police, 19 May 2026.

Fraudsters also pose as the bank's fraud prevention team and have software installed on the pretext of checking that online banking is secure.

Your bank will not ask for your PIN over the phone, nor, as the Vaud police have pointed out, will it ask you to transfer your assets to another account to keep them safe. The bank's name appearing on your screen proves nothing, since the number displayed can be falsified. If a transaction worries you, it will appear on your statements, which you can check yourself.

The call is made in the name of the police, a prosecutor, a bank or a government office. The caller mentions an investigation, a hacked account or a relative in difficulty, in an urgent and authoritative tone intended to make you feel guilty. You are then asked to transfer your money to an account presented as safe or to hand cash to an intermediary. Sometimes the caller also asks for your login details, always on the pretext of protecting your assets.

You are told to keep the matter secret, and the pressure is kept up on the phone to leave you no time to check. The word "Police" appearing on the screen proves nothing, since the number displayed can be faked by a technique within anyone's reach, known as spoofing.

In the canton of Vaud, fake police officer scams rose by 153.7% in 2025. There were fewer than 40 cases in 2023, then 369 in 2024 and 936 in 2025, attempts included, with losses of over CHF 1.4 million. The canton of Vaud reports that this type of scam targets older people above all.

According to Canton of Vaud, 2025 crime report, 23 March 2026.

The obligation to mark calls from abroad that spoof a Swiss number, in force for landlines since January 2026, was extended to mobile phones on 1 July 2026. Fake calls in the name of the authorities reported to the National Cyber Security Centre (NCSC), which regularly exceeded 400 a month, fell to fewer than 100 in July 2026, a drop of more than 75%.

According to NCSC, 24 August 2026 and Geneva cantonal police, 8 April 2025.

It generally starts with an advertisement on a social network, sometimes featuring the face of a well-known figure used without their consent. A so-called adviser then guides you for several weeks, patient and reassuring, while a dashboard shows your gains rising. On the day you want to withdraw your money, you are asked to pay an unexpected fee, then another. The funds do not come back, since they were never invested.

At the end of October 2025, operations carried out in five European countries against a network suspected of laundering EUR 600 million led to nine arrests. The dozens of fake cryptocurrency investment platforms involved were promoted through social media advertising, fake press articles and fake celebrity endorsements.

According to Eurojust, 4 November 2025.

The promised return is guaranteed, or simply too regular to be true, whereas markets go up and down. A small first withdrawal is frequently allowed in order to build trust and lead you to pay in a larger sum, after which nothing more comes out.

The promise sometimes takes written form, with the self-styled manager having the investor sign a proper-looking contract that guarantees a high return. Requests for further payments then follow one after another and, when repayment is due, the explanations change from one time to the next.

In Geneva, this fraud grew in 2025 while digital crime there fell by 27%. The canton recorded 125 cases of online investment fraud, compared with 87 in 2024, a rise of 44%. Nationally, the National Cyber Security Centre (NCSC) received 3,485 reports of fake investment ads in the first half of 2025, nearly five times as many as a year earlier. In 2025 as well, FINMA made more than 300 entries on its warning list, a record.

According to Canton of Geneva, 2025 police crime statistics, NCSC, 18 November 2025, FINMA, 21 April 2026 and FINMA, warning list.

The investment is not backed by any real business activity. The gains paid to the first investors come from money brought in by new entrants, so that everything seems to work for as long as money keeps coming in. Withdrawals go through without difficulty and confidence spreads, by word of mouth as well as on social media.

The scheme is all the more dangerous because it gives no warning. It holds as long as the money coming in exceeds withdrawals, then collapses all at once on the day the flow dries up or a wave of withdrawals arrives. The last to join then lose everything, with no sign of what was coming. In a Geneva case reported in January 2025, around seventy people in Geneva and neighbouring France reportedly lost some CHF 8 million.

According to World Radio Switzerland, 28 January 2025.

A high and regular return is presented to you as safe, and payment sometimes depends on the number of investors you bring in. Explanations of what the money is actually invested in remain vague. Withdrawals go through smoothly at first, then are delayed or blocked as they multiply.

The scam takes many forms. It may be a fake exchange, a fake automated trading bot, a so-called adviser who manages your assets or a worthless token sold as the next big thing. In every case, you are asked to transfer cryptocurrency to a wallet or platform chosen for you, or to buy some in order to invest, and the funds go to addresses controlled by the fraudsters. The promises of high returns borrow the language of crypto, "10x guaranteed" or "risk-free trading", and someone keeps insisting on helping you install an app or connect your wallet.

In the fake investment ads reported to the NCSC, the perpetrators impersonate well-known figures, including Federal Councillor Karin Keller-Sutter, by means of deepfakes.

In October 2025, the US Department of Justice indicted the chairman of a Cambodian group for fraud and money laundering and brought a forfeiture action covering approximately 127,271 bitcoins, worth some USD 15 billion, the largest in its history. The prosecution alleges that the group's scam compounds operated as forced labour camps, where victims of human trafficking carried out cryptocurrency investment scams on a worldwide scale.

According to NCSC, 18 November 2025 and US Department of Justice, 14 October 2025.

Unlike a bank transfer, a cryptocurrency transaction cannot be recalled. Every transfer leaves a trace on the blockchain, although the money moves fast and crosses borders within minutes. The funds nonetheless frequently pass through regulated exchanges, where a request from the authorities to block them can freeze whatever has not yet been withdrawn.

Once the transactions are traced on the blockchain, platforms presented as separate businesses sometimes turn out to lead to the same wallets and then to deposit addresses at large exchanges that identify their customers. That tracing, attached to the criminal complaint, tells the authorities which exchange to approach.

Phishing means posing as a well-known organisation in order to obtain your login details. The message appears to come from your bank, the post office, a phone provider or a public authority. It mentions a parcel on hold, a suspicious payment or an account to be verified, and invites you to click without delay. The link opens a faithful copy of the real site, so that everything you type there, including your password and the code received by text message, goes straight to the fraudsters, who use it within minutes.

The address of the sender, or of the site, usually differs slightly from the original, whereas the display name, which is very easy to fake, looks right. The message plays on urgency or a threat, and the page sometimes asks for a security code, which no legitimate service does in this way.

The details obtained in this way can be used at a later stage to take over an account or to order a fraudulent transfer. When the fraudster works through a phone call, this is known as vishing, and as smishing when the message arrives by text. The NCSC states that phishing links can be reported on antiphishing.ch, a site it operates.

According to NCSC, phishing.

Twint users receive messages of this kind in forms specific to the app, such as a fake refund request, a fake customer service reached through a messaging app or a fake identity check. Read the page on Twint scams.

A warning window opens on your screen with a number to call urgently, or a stranger phones you in the name of a large software company. You are told about a virus, a hacking attempt or an account under threat. The caller then has you install remote access software, which gives them full control of your computer, or makes you pay for a repair or a protection subscription to deal with a problem you had not noticed. Payment is often requested in gift cards or cryptocurrency.

No software company, and no bank either, will call you out of the blue to report a virus. The method has hardly changed from one year to the next and is aimed at a wide public.

In a romance scam, the first contact takes place on a dating site or a social network. The exchanges, attentive and daily, go on for weeks or months, and genuine trust takes hold. Then something unexpected happens, whether an accident, a business opportunity or goods held up at customs, and money has to be sent. The requests keep coming after that, each time with a justification, until the victim's resources are exhausted.

The other person refuses video calls and keeps putting off any meeting, so that after weeks of messages you have not seen their face live and do not know who you are talking to. The attachment formed quickly and intensely and has been kept up at a distance, while their personal story always leads to a need for money, with the pretext changing from one request to the next.

The harm goes beyond the money lost. Shame and the emotional bond can delay a criminal complaint, which reduces the chances of taking action.

When you are buying, an online shop with unbeatable prices or a tempting ad takes your payment and delivers nothing. New goods at half price or a rare item that has finally become available are the usual examples, and you are hurried along with talk of the last one in stock or an offer that ends that same evening, so that you have no time to think. A site whose domain name was registered the week before, with no reviews and no address, should also make you wary.

The person behind the ad may also push you to pay outside the platform's secure channels, by direct transfer or through a payment app, which deprives you of the protection the platform offers.

When you are selling, the method is reversed. A buyer in a hurry sends proof of a payment larger than the price, usually forged, claims to have made a mistake and asks you to refund the difference. The refund goes out before the bank reveals that nothing has arrived in your account.

The offer arrives by message, on a social network or a messaging app, and promises high pay for simple tasks, with flexible hours. The salary bears no relation to the effort required and the recruitment is settled with a stranger over a messaging app, which no serious company does.

In the first half of 2026, the NCSC found that people looking for work were specifically targeted with fake job offers and fake investment schemes, using content personalised by means of artificial intelligence.

According to NCSC, semi-annual report 2026/1, 24 August 2026.

What follows takes one of two forms. Either you are asked to pay upfront for equipment, training or administrative fees, or to pay a deposit, and the money disappears, even though a genuine employer does not charge the people it hires. Or you are made to receive money and send it on, which turns you into a relay in a money laundering chain.

It also happens that the offer pays for small online tasks, such as liking videos, and that the salary can supposedly be received only through an account opened, at the recruiter's request, on a cryptocurrency platform. The earnings appear there, but withdrawing them requires completing missions that involve paying in one's own money. People are sometimes told not to discuss the exchanges with anyone, and the platform may change its web address along the way.

The second variant exposes you to criminal liability, since receiving money and sending it on for a stranger can lead to money laundering proceedings. The offence requires that the criminal origin of the funds was known, or at least considered possible and accepted, and mere carelessness is not enough. The authorities refer to a person who lends themselves to these transfers as a money mule or, in French-speaking Switzerland, as a passeur d'argent or agent financier. If this has already happened to you, read My account was used in a scam.

According to Fribourg cantonal police, 27 March 2025 and Zurich cantonal police, cybercrimepolice.ch, 9 April 2025.

Your phone suddenly loses its signal for no apparent reason. Shortly afterwards, password change emails arrive that you did not request, and then you can no longer open one of your accounts. These signs may point to a SIM swap, in other words the fraudulent transfer of your number to another SIM card.

Using information gathered about you, the fraudster has persuaded your mobile operator to transfer your number to a new card. Their phone then receives your calls and text messages, and they trigger the recovery procedures for your accounts, which rely on codes sent by message. In this way they gain access to your email, your bank accounts and your digital wallets.

Every minute in which they keep control of the number opens further access for them, so the response has to be immediate. A verification code that arrives when you have not requested anything means that someone is trying to get into one of your accounts.

The perpetrator may also, once in control of the number, link their own numbers or an account of their own to the victim's social media accounts, so that the platform sometimes suspends all of them, the victim's included.

An intimate exchange begins, either with a real person or with an entirely invented profile. The encounter turns very quickly, sometimes within minutes, to the sending of images, following a script prepared in advance. The images are obtained or fabricated, and then comes the threat to send them to your family and contacts within a short time unless you pay, often in cryptocurrency.

Paying does not end the blackmail, since the perpetrator takes it as proof that you are a source of income. The threatened disclosure is most often a bluff, with the perpetrator relying on your fear to obtain the money. Shame is their main lever, and it is also what holds many victims back from filing a complaint.

Someone contacts you out of the blue after you have been the victim of fraud. They say they are an investigator or a lawyer, or present themselves on behalf of a service specialising in asset recovery, and promise to bring your funds back in exchange for upfront fees or a commission. This is a second scam, sometimes set up by the same team that has already deceived you.

The NCSC notes that fraudsters often get back in touch later, sometimes years afterwards, presenting themselves as lawyers, companies or authorities and asking for a further payment to recover the money lost. The ebas.ch site mentions the supposed private investigator, lawyer and public prosecutor.

On 17 April 2026, an operation in Austria and Albania led to ten arrests in a case involving call centres based in Tirana, with losses of more than 50 million euros. The perpetrators got back in touch with victims who had already lost money, offered to recover their funds, and then had them open a cryptocurrency account and deposit 500 euros.

According to NCSC, online investment fraud, ebas.ch, 18 September 2026 and Eurojust, 29 April 2026.

The person knows your case with unsettling precision, which is easily explained where they are behind the fraud themselves or have bought the information. They promise a result, whereas nobody can guarantee that funds lost to fraud will be recovered.

The program gets into the computer, for instance through an infected attachment or a link, and encrypts the files. Documents, photos and accounting records become unreadable. A message then appears, usually with a countdown, demanding a ransom in cryptocurrency in exchange for the decryption key. The attackers sometimes also threaten to publish the data they have stolen if the ransom is not paid.

The affected files carry an unfamiliar extension and no longer open. In some cases the computer had become slow or unstable shortly before it was locked. Every ransom paid keeps this kind of attack going, and nothing guarantees that a payment will restore access to the files.

Under Swiss law, breaking into someone else's computer may constitute unauthorised access to a data processing system, where that system is specially protected (art. 143bis of the Swiss Criminal Code, SCC), and encrypting its data may constitute damage to data (art. 144bis SCC). Both offences are prosecuted on complaint, which must be filed within three months of the day on which the injured party learnt who the perpetrator was (art. 31 SCC). Damage to data is, however, prosecuted ex officio where the harm caused is considerable. The ransom demand itself may amount to extortion (art. 156 SCC), which is prosecuted ex officio.

The intruder gets into the account with a password that they guessed or obtained through a data leak or phishing, which is all the easier when the same password is also used elsewhere. They then change the login details to lock you out and use the account to read your messages, defraud your contacts in your name, get into the services linked to it or sell the access on.

You realise what has happened when your password stops working and you can no longer log in. Your contacts may also receive messages that you did not send, or the account may show logins and activity that you do not recognise.

Email is of particular interest to the intruder, since it can be used to reset almost every other account, and that is where reacting quickly does most to limit the damage.

Getting into someone else's account without authorisation may constitute unauthorised access to a data processing system, provided that the system is specially protected (art. 143bis SCC). This offence is prosecuted on complaint, which must be filed within three months of the day on which the injured party learnt who the perpetrator was (art. 31 SCC).

The program gets in through an infected app or attachment, a fake update or a compromised website. Depending on its type, it records what you type, steals your passwords and online banking details, pushes advertising onto your screen or turns your device into a relay for other attacks. It is designed to go unnoticed and to stay in place. A few clues may nevertheless give it away. The device slows down or heats up for no apparent reason, the battery runs down quickly, and pop-up adverts or apps that you never installed start to appear. Unusual network connections are sometimes detected as well, or accounts are hacked shortly afterwards.

Malware is rarely an end in itself. It serves as a tool for preparing theft, bank fraud or the hacking of accounts, and using it may amount, depending on the case, to unauthorised obtaining of data or damage to data (arts. 143 and 144bis SCC).