12.09.2023 -For the past two years, threatening emails purporting to come from the police or other authorities have been among the most reported cases at the NCSC. After using similar content for a long time, the attackers are now using a new variant to try and unsettle the recipients with allegations of tax evasion.
For almost two years now, the NCSC has been receiving reports of emails that are supposedly from various police authorities or from the NCSC. The recipients are accused of possessing child pornography and are told that they therefore have to pay a fine.
However, in a new variant reported to the NCSC last week, the recipient is no longer accused of consuming prohibited pornography, but of being guilty of tax evasion or tax fraud. Federal Councillor Keller-Sutter, who is described in the letter as a financial inspector, is supposed to have signed the documents. A list of offences is included to give weight to the demand. These are said to be offences relating to wealth tax, real estate tax or social security contributions, among other things. The variety is probably not a coincidence. The fraudsters' aim is to increase as much as possible the probability that one of the accusations could fit. The NCSC assumes that the previous accusation of having consumed child pornography, which might initially cause shock and uncertainty among the recipients, does not hold water upon further consideration, as the accusations are not plausible. Accordingly, the success rate has probably decreased over the months. It can therefore be assumed that the scammers are currently testing new variants and trying to choose topics that expand the pool of potential victims who will react and fall for this scam.
In the current case, the victim is threatened with five years' imprisonment and a fine of up to EUR 500,000. However, the fine can be averted by paying EUR 7,000 within the next 48 hours. A Gmail address is then given as the contact address to make the payment. This is when all alarm bells should be ringing, at the very latest.
There are several indications that the current variants are probably the work of the same perpetrators. As with the original variant, the emails in this case are also sent primarily via hacked French university email servers. Another indication is that in this case, too, the emails initially appeared in French. The perpetrators, who are presumed to be French-speaking, will only go to the trouble of translating and extend their sphere of action to the German-speaking area when they are sure that a variant will work.
Such threats are baseless and are therefore considered to be fake extortion. To increase the likelihood that someone will respond to the fake extortion, the perpetrators often send several similar threats.
- Do not allow yourself to be put under pressure and do not react to such threats.
- Bear in mind that email sender IDs can easily be spoofed.
- Be sceptical if you receive emails that require action on your part and that carry a threat of consequences (loss of money, criminal charges or criminal proceedings, blocking of an account or card, missed opportunity, misfortune) if you do not do what is required.
- Ignore fake extortion emails and do not allow yourself to be intimidated.
- Contact the cantonal police if you are unsure.
- By submitting a report to the NCSC, you will help to ensure that such threats are identified at an early stage and that other people are warned about them.
Current statistics
Last week's reports by category:
Last modification 12.09.2023
