Scams and phishing in Switzerland: the traps of 2026 and how to react

By Ricardo Da Silva, RSCOM · 10 October 2026

The Swiss Federal Office for Cybersecurity (NCSC/BACS) receives hundreds of reports every week. Scammers often change their pretext, but their methods stay the same: urgency, fear and pressure. Here are the most frequent traps this year, and the right reflexes to beat them.

1. Fake technical support

A full-screen window appears: “Your computer is infected, call Microsoft support immediately”. Sometimes it plays a sound or locks the browser. It is always a scam: Microsoft, Apple or your bank never display a number to call in an alert. On the phone, the “technician” asks you to install remote-control software, then to log in to your e-banking.

The right reflex: close the browser (if needed with Ctrl + Alt + Del, then “Task Manager”), do not call, install nothing.

2. Fake call-backs

Rising sharply according to the NCSC: an e-mail or text announces an imminent debit or a purchase you did not make (subscription, antivirus, online order). To “cancel”, you have to call a number. On the line, a fake adviser pressures you into giving your bank details or approving a payment.

The right reflex: never call back a number received by e-mail or text. Contact your bank or card issuer yourself, using the number on the back of the card or on its official website.

3. TWINT phishing and fake buyers

You sell something on a classifieds platform; a “buyer” sends you a link or QR code to “receive the money”. In reality you approve a payment to them. Cases targeting TWINT have been increasing since spring 2026.

The right reflex: to receive money, you never need to enter a code or confirm anything in your app.

4. Fake parcel, fake vignette, fake invoice

“Your parcel is held, customs fee CHF 2.90”, “Your e-vignette has been deactivated”, “Unpaid invoice”: the link leads to a perfect copy of the Swiss Post, the administration or a supplier, which collects your credit card. Some scams combine a fake delivery notice (with a QR code) and a phone call.

The right reflex: never pay from a link you received; go to the official website yourself by typing its address or through the official app.

5. The fake CAPTCHA (“ClickFix”)

A new trap on hacked websites: a fake “I’m not a robot” asks you to press Windows + R, then paste and run some text. That text actually installs malware. No real CAPTCHA ever asks you to type a command.

6. The voice (and now AI)

Phone phishing (“vishing”) has become the most reported type of incident. With artificial intelligence, scammers even imitate the voice of a boss or a relative to request an urgent transfer (“CEO fraud”). In a company, any unusual transfer must be confirmed through a second channel (call the person back on their usual number).

You clicked or gave information: what now?

1. Card or e-banking: call your bank immediately to block the card or access.
2. Remote-control software installed: disconnect the computer from the Internet, uninstall the software and have the computer checked.
3. Password entered: change it everywhere it is used and enable two-factor authentication.
4. Report the scam to the NCSC (form on bacs.admin.ch) and file a complaint if you suffered a loss.

For companies: 4 simple protections

• Two-factor authentication on Microsoft 365, e-banking and every important account.
• An anti-phishing filter and a modern antivirus (EDR) on every computer.
• A clear rule: no payment or IBAN change without confirmation by phone.
• A short awareness session for the team once or twice a year.

Sources: alerts and 2026 half-year report of the Swiss Federal Office for Cybersecurity (NCSC).

Read also

• Two-factor authentication is no longer enough: 5 blind spots to know
• Slow Wi-Fi at the office: the real causes (and is Wi-Fi 7 worth it?)
• Personal computers and external providers: how to protect company data

← All articles