In short: The mandatory caller ID requirement for calls from abroad using spoofed Swiss numbers is working. In July 2026, the National Cyber Security Centre (NCSC) received fewer than 100 reports of fraudulent calls in the name of public authorities, after regularly receiving more than 400 a month in the first half of the year. According to the Semi-Annual Report 2026/1, overall reporting nevertheless remains high at 27,128 voluntary and 200 mandatory reports, and fraud still dominates.
Key facts
- Fake authority calls: regularly more than 400 reports a month from January to June 2026, fewer than 100 in July 2026, a drop of more than 75 per cent
- Caller ID requirement: first phase for landline numbers in January 2026, extended to mobile numbers on 1 July 2026
- Reports, first half of 2026: 27,128 voluntary reports (first half of 2025: 35,727) and 200 mandatory reports from critical infrastructure
- Most frequent phenomena: fraud (10,759), phishing (8,877), spam (3,965)
- Ransomware: 79 reported and observed cases, the same number as in the second half of 2025
- Mandatory reports by attack type: hacking just under 26%, theft of access credentials 13.5%, DDoS and data leaks 12.7% each, ransomware around 8%
- Source: NCSC Semi-Annual Report 2026/1 and media release of 24 August 2026
Fewer reports, more sophistication
Voluntary reports fell compared with the same half-year in 2025. For “fraudulent threatening calls in the name of authorities”, the report records 3,817 reports in the first half, 64 per cent fewer than in the first half of 2025. CEO fraud (258, −57%) and advertising for online investment fraud (387, −89%) also declined.
According to the NCSC, however, attacks are becoming more targeted, more emotional and technically more sophisticated. Around 39 per cent of all reports concerned fraud attempts. Criminals use artificial intelligence systematically to create personalised content; in one CEO fraud case, a manager’s voice was imitated. Phishing by telephone has become the most frequently reported phishing method.
Businesses in the crosshairs
For companies, the report highlights in particular:
- more reports of taken-over Microsoft 365 accounts used for further phishing and fraud, sometimes bypassing multi-factor authentication
- attackers posing as the IT help desk or executives, for example via Microsoft Teams
- fake security updates used as bait for malware
- at least 191 compromised Swiss WordPress websites serving malicious code to visitors
- fake dream jobs offered via LinkedIn to steal crypto assets from victims and their employers
Ransomware is becoming more fragmented: Akira remains the most documented group, but its share fell from around 35 to 19 per cent, while the number of active ransomware families rose from 21 to 29. The NCSC assumes the actual number of cases is higher.
What this means for Swiss SMEs
- Set call-back rules: always verify payment orders and access requests received by phone or Teams via a known number.
- Harden Microsoft 365: phishing-resistant sign-in, monitoring of new forwarding rules and staff training.
- Keep your website up to date: patch WordPress, plugins and firewalls promptly.
- Prepare for incidents: operators of critical infrastructure must report attacks to the NCSC within 24 hours; see reporting obligations.
- Cover the residual risk: take the cyber risk check and check whether a policy includes social engineering losses; more in Cyber insurance for SMEs, costs and our comparison.