Week 29 in review

27.07.2021 - The NCSC received few reports last week. DDoS attacks by the Fancy Lazarus group continue to be reported. However, the second attack that had been threatened has yet to be observed. A perfidious approach to classified ad fraud led to losses for one victim. Fraudsters' attempts to lure people into dubious investment offers are becoming more and more sophisticated.

Item sold and yet CHF 150 paid

The NCSC regularly receives reports of cases where the seller of an item on a classified ads platform is supposed to pay a fee before the sale, e.g. for transport or bank transfer costs. There are many variants with this type of fraud and they are becoming increasingly sophisticated. In one case reported to the NCSC last week, the supposed prospective buyer contacted the seller via WhatsApp. He pretended to have instructed the logistics service provider DHL to organise the transport of the item. The victim did indeed receive an email purporting to be from DHL shortly afterwards. This email explained that an account had just been opened in the victim's name and that the purchase amount of CHF 500 was ready for dispatch. However, the account had to be activated first and a fee of CHF 150 paid, which would then be refunded.

The payment had to be made using a so-called paysafecard. The code on the card, which authorised the withdrawal of the 150 CHF, was then to be sent to an email address supposedly belonging to DHL. However, the address was a Gmail account. The seller should have noticed the fraud attempt at this point at the latest. Unfortunately, in the reported case, the victim fell for the scam and lost CHF 150.

Be alarmed if someone asks for paysafecards to pay invoices. Companies do not usually do this.
Be careful with demands from buyers. Insist on shipping and transaction fees being paid by the buyer. Also write this explicitly in the advertisement.
Use the classified ad platform's rating system. Check buyers' reviews. However, bear in mind that ratings can also be bogus, especially if there are some very good and some very bad reviews.

"Office of Electronic Stock Exchange Trading" wants to verify portfolio

Last week, the NCSC received two reports of emails from a supposed "Office of Electronic Stock Exchange Trading". They claimed that one of the recipient's portfolios had to be verified. Without this verification, trading instruments and financial products would not be made available. The emails, which used the correct form of address but incorrect German, claimed that the recipient could not be reached by telephone and should therefore call back on the number provided.

The fraudsters speculate that a victim is actually active on the stock markets and will therefore call the number given. Afterwards, they try to trick the victim into investing in dubious stock exchange transactions or paying bogus fees.

Be wary of emails from supposed authorities. As a rule, an authority will never send you unsolicited emails.
Generally, the greater the promised return, the higher the risk.
Check whether the financial service provider has been authorised by the Swiss Financial Market Supervisory Authority (FINMA).
The FINMA website contains information on authorised financial service providers in Switzerland:
https://www.finma.ch/en/finma-public/authorised-institutions-individuals-and-products/
Particular caution is required if the financial service provider is not authorised. Check out the financial service provider using online experience reports. FINMA also has a non-exhaustive warning list:
https://www.finma.ch/en/finma-public/warning-list/
Never let salespeople put you under pressure.

Especially interesting:
In this case, the address of the alleged office was also given as "19, Avenue de la paix" in Geneva. This address does exist, but instead of belonging to an "Office of Electronic Stock Exchange Trading" , it is home to the International Red Cross (ICRC). The misuse of this ICRC address is apparently popular with such platforms. FINMA also warns against the fraudulent trading company "RoyalsFX", which also states its place of business as "19, Avenue de la paix". Various warning sites associate the telephone number with dubious trading companies that are well known.