Deception (social engineering): Private individual, Switzerland 2026
The perpetrators created a Google account with the victim’s email address as the recovery address, whereupon Google sent a genuine security alert containing their text.
- Incident · 09.2026 · Switzerland
- Evidence: confirmed by an authority
- Deception (social engineering)
- Phishing
- Account takeover
As of
What happened
Shortly afterwards, a supposed Google employee called from a spoofed Swiss landline number and directed the victim to a login form on «Google Sites». Using the login data, the perpetrators set up an app password; for a long time afterwards, emails and contacts were still synchronised to a device abroad.
- Affected
- Private individual (anonymous)
- Industry
- Private individual
- Loss
- no reliable figure
- Business interruption
- unknown
- Ransom demanded / paid
- unknown / unknown
- Data affected
- Emails and contacts of the Google account
- Bankruptcy
- no
- Entry point
- genuine Google security alert with injected text, call from a spoofed Swiss number, phishing form on Google Sites
What would cyber insurance have paid?
That depends on the terms. Whether those affected were insured: unknown.
-
Social media, email or shop taken over
Mostly no information 14 of 29 private products cover it fully, as an add-on or with limits.
-
Remove malware, restore data and devices
Mostly no information 15 of 29 private products cover it fully, as an add-on or with limits.
-
Orders and accounts in your name
Mostly limited 22 of 29 private products cover it fully, as an add-on or with limits.
-
Hotline and advice before anything happens
Mostly no information 14 of 29 private products cover it fully, as an add-on or with limits.
Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.
What we can learn
Google and Microsoft never call of their own accord; after an incident, delete all app passwords and unfamiliar sessions.
Sources
- Woche 38: Echte Google-Mails, vermeintlicher Support und eine gefährliche Hintertür (opens in a new window) Bundesamt für Cybersicherheit BACS · 22.09.2026
«Dadurch behielten die Täter selbst nach einer Passwortänderung weiterhin Zugriff auf das Konto.»