Week 15: Fake bank employees are asking customers to install remote maintenance software
The NCSC has recorded an increase in reports of fraudulent phone calls, known as voice phishing or "vishing". Criminals call people on the phone posing as employees of well-known Swiss banks supposedly to stop alleged incorrect transactions. However, OFCOM has also recently been misused in connection with this type of fraud. The perpetrators’ insidious aim is to convince victims to install remote access software such as "AnyDesk", which then allows the fraudsters to gain full control of the computer.
This "vishing" scam is highly manipulative and aims to put victims under enormous psychological pressure catching them off guard. Over the past week, the NCSC has received an increasing number of reports of cases in which callers have pretended to represent major, well-known Swiss financial institutions.
Building trust through leaked data
The scam usually begins with a phone call from someone claiming to be a bank employee. The caller speaks in a concerned tone and claims that an unusual or suspicious transaction has been detected on the victim’s account. To stop the transaction, they say, they need to check the security systems together.
What is particularly insidious about the current wave of scams is that the callers come across as extremely credible and often already know the full name and home address of the person they are contacting. This accurate personal information is intended to instil trust in the victim and reinforce the authenticity of the call. The criminals most likely obtain such information in advance from publicly available sources (telephone directories, social media) or from past data breaches (leaks).
Transfer to the supposed "IT specialist"
The victim is then "put through" to a supposed IT specialist from the bank to check the security settings together.
This supposed specialist then explains to the victim that their online banking app or computer has been infected with malware. To resolve the issue, clean up the computer and secure the customer’s money, a "support tool" or "security app" needs to be downloaded right away.
Victims are effectively pressured into installing remote support software such as "AnyDesk" (or similar programmes like "TeamViewer"). These are actually legitimate remote support programmes frequently used for IT support. However, if the victim grants access via this software, it allows the criminals to access their computer. The fraudsters can then view the victim’s screen, control the mouse, intercept passwords and login details in the background, install programmes and gain access to online banking apps.
New scam: Vishing in the name of OFCOM
Scammers are now also posing as employees of the Federal Office of Communications (OFCOM). The person receiving the call is told that their telephone number is being blocked or has already been blocked. The exact details of how this scam works are not yet fully known to the NCSC, as only a few reports have been received so far. However, based on similar scams, it can be assumed that the fraudsters will then attempt to obtain personal details or persuade the victims to install software in order to lift the alleged phone block.
Recommendations
- Banks, credit card companies and government agencies will never ask you over the phone to install remote access software (such as "AnyDesk", "TeamViewer", etc.) on your computer or smartphone.
- If you receive such a call, hang up straight away.
- If you provided your credit card details, contact your credit card company immediately to have the card blocked.
- If you provided your password, change it immediately wherever you use the same password. If possible, enable two-factor authentication.
- Use a different, strong password for each online service.
- In the case of an email password, you should also reset all passwords for online services where you registered using that email account.
- If you have been tricked into installing remote access software, uninstall it immediately and change all passwords that you use on the device concerned.
- If you have suffered a financial loss, we recommend that you report it to the police. You can find your nearest police station on the Suisse ePolice website (available in German, French and Italian).
Further information
Online banking phishing: When a call from your "bank" is a trap
Current statistics
Last week's reports by category: