Phishing: Private individual, Switzerland 2025
Victims received an email about a supposed tax refund and entered personal details, bank details and credit card data on a deceptively real website.
- Incident · 09.2025 · Switzerland
- Evidence: confirmed by an authority
- Phishing
- Deception (social engineering)
- Account takeover
As of
What happened
A few minutes later, a supposed security department of their bank called and asked for remote access to the computer and a login to e-banking. This allowed the attackers to trigger payments or change settings.
- Affected
- Private individual (anonymous)
- Industry
- Private individual
- Loss
- no reliable figure
- Business interruption
- unknown
- Ransom demanded / paid
- unknown / unknown
- Data affected
- unknown
- Bankruptcy
- no
- Entry point
- Phishing email with a supposed tax refund, followed by a call from the fake bank
What would cyber insurance have paid?
That depends on the terms. Whether those affected were insured: unknown.
-
Misuse of card, Twint, e-banking
Strangers pay with your money
Mostly limited 25 of 29 private products cover it fully, as an add-on or with limits.
-
Social media, email or shop taken over
Mostly no information 14 of 29 private products cover it fully, as an add-on or with limits.
Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.
What we can learn
If the bank calls shortly after you have entered data, it is almost always the second stage of the same fraud: hang up and call the bank yourself.
Sources
- Wochenrückblick Woche 39: Wenn ein Phishing-Versuch auf den nächsten folgt (opens in a new window) Bundesamt für Cybersicherheit BACS (bis 2023: NCSC) · 30.09.2025
«Nur wenige Minuten nach der Eingabe der Kreditkartendaten erhielten die Opfer einen Anruf einer angeblichen Sicherheitsabteilung ihrer Bank.»