Week 8: Phishing tricks – deceptive emails and how you can protect yourself

25.02.2025 - Phishing continues to be one of the most commonly reported scams – and unfortunately one that many people fall victim to. Scammers go to great lengths to make their messages look as real as possible, using a variety of tricks to increase their chances of success.

Phishing is basically when someone tries to trick you into giving them your personal information (usually passwords or credit card details) so that they can use it to commit other fraudulent acts. Fake websites that trick victims into entering their details are often a key part of phishing scams. Scammers usually contact their victims by email, but text messages and phone calls are becoming increasingly popular.

So there are usually two components that have to work together: on the one hand, the initial contact (a phishing message) and, on the other hand, the request for data (a phishing site on the internet).

Fake refund scams

Scammers often send emails claiming that you are entitled to a refund (saying, for example, that you paid more tax than you owed during the year, or that you paid the same bill twice). This type of scam works because it seems plausible – and who wouldn't want a refund?

A fraudulent refund email sent in the name of a health insurance company.

Scams that use popular brands

Swiss Post, Swisscom, SBB and SwissPass are the brands most frequently used in phishing scams reported to us. These companies have a large customer base and are considered trustworthy. Spammers know that if they send mass emails claiming to be from these companies, they are likely to reach many people who are actually customers of these companies. Anyone who happens to be expecting a parcel from Swiss Post, or who really does need to renew their SwissPass, is more likely to fall for the scam.

Deceptively real-looking phishing websites

Fake sender scams

Email sender addresses are, unfortunately, easy to fake. In addition, many programs and apps (especially on smartphones) don't even show you the sender address, just a name. It takes a bit of expertise to analyse an email header and see where a spoofed email really came from.

In some cases, the sender addresses of phishing emails are real. We have received reports of phishing emails that were sent from booking.com. But how is this possible? In these cases, it is likely that a hotel's account on booking.com has been hacked. We reported on this type of scam in our Weekly Review 10/2024.

Scams that use phishing links

Scammers sometimes hack websites in order to insert their own phishing links. In other cases, they register their own domains, or create free temporary subdomains on real companies’ websites. This is usually enough for them to carry out a quick phishing campaign, and they benefit from the company’s trustworthy name.

The way website addresses (URLs) are displayed can also be misleading. In some cases, you may not be able to see that a URL is a scam unless you have a wide enough screen:

An obvious scam URL as seen on a wide monitor.

On the small screen of a smartphone, however, the URL is cut off and only part of it is visible. Not so coincidentally, this is the part that looks exactly like the real Swiss Post domain (post.ch).

Abgeschnittene Phishing-URL auf einem Gerät mit kleinem Bildschirm (z. B. Smartphone) — A truncated phishing URL as seen on a device with a small screen (e.g. smartphone)

Recommendations

Be careful when asked for personal information by email, text message or phone. If in doubt, go to the website via the official link, not the one in the message, or call the company's support line;
Never enter sensitive information, such as credit card details or passwords, on a site that you have accessed through a link in an SMS or email;
If you have entered your password on a phishing site, change it immediately wherever you use it. This is particularly important for email passwords;
Report the phishing URL to www.antiphishing.ch (if you would like a response to your report, use the NCSC online form instead);
If you have shared your credit card details with a scammer, contact the credit card company immediately so that they can cancel your card;
Be especially careful when clicking on short links where the address is not visible. Make sure the link takes you to the correct page;
In the event of financial loss, we recommend that you file a report with the cantonal police. You can find the contact details of your nearest police station on the Suisse ePolice website.

Current statistics

Last week's reports by category:

Current figures