Phishing: Private individual, Switzerland 2024
Via a phishing page and a fake prize draw, the attacker obtained the password and SMS code for a victim’s mobile account and created an eSIM.
- Incident · 05.2024 · Switzerland
- Evidence: confirmed by an authority
- Phishing
- Account takeover
As of
What happened
With the redirected text messages, he took over the email and Apple accounts, restored the backup onto his own phone and could thus see the installed crypto apps. He then reset their passwords in a targeted way; the loss amounted to more than 20'000 francs.
- Affected
- Private individual (anonymous)
- Industry
- Private individual
- Loss
- CHF 20'000
- Figure given by the source
- more than 20'000 francs
- Business interruption
- unknown
- Ransom demanded / paid
- unknown / unknown
- Data affected
- unknown
- Bankruptcy
- no
- Entry point
- Phishing page for the mobile provider’s customer portal, fake prize draw for the SMS code
What would cyber insurance have paid?
That depends on the terms. Whether those affected were insured: unknown.
-
Social media, email or shop taken over
Mostly no information 14 of 29 private products cover it fully, as an add-on or with limits.
-
Orders and accounts in your name
Mostly limited 22 of 29 private products cover it fully, as an add-on or with limits.
-
Misuse of card, Twint, e-banking
Strangers pay with your money
Mostly limited 25 of 29 private products cover it fully, as an add-on or with limits.
Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.
What we can learn
Even an apparently unimportant password such as that of the mobile account can be the key to all other accounts.
Sources
- Wochenrückblick Woche 19: Smartphone als Achillesferse: Wie Cyberkriminelle die Zwei-Faktor-Authentifizierung aushebeln (opens in a new window) Bundesamt für Cybersicherheit BACS (bis 2023: NCSC) · 14.05.2024
«In diesem Fall entstand ein Schaden von insgesamt über 20'000 CHF»