Week 37: Sharp rise in callback scams, often using the area codes 021, 022, 026 and 071
Fraudsters are sending emails and text messages claiming fake Migros invoices, suspicious TWINT transactions or bank debits to trick their victims into calling a particular telephone number. Anyone who calls the number ends up speaking directly to the fraudsters. The caller is then pressured into revealing sensitive data or making payments during the call. The number of cases reported to the NCSC involving this scam has risen significantly in recent weeks.
Numerous cases of callback fraud have been reported to the NCSC in recent weeks, with the number of reports escalating in the last few days.
The scam begins with an email or text message claiming that a suspicious transaction or unauthorised payment has been made from your bank account. The fraudsters claim that they can stop the alleged charge or reverse the transaction if you respond quickly and call a certain number within a deadline. They tell you that if you do not respond in time, the transaction or payment may be debited from your account. However, these claims are completely fabricated.
The fraudsters typically provide a telephone number that you can call if you have any queries or to have the payment cancelled. These are often foreign landline numbers, but increasingly Swiss ones as well, particularly those with the area codes 021, 022, 026 or 071. These area codes are intended to give you the impression that the telephone numbers are legitimate and to encourage you to make a call.
Anyone who calls this number will be put through to what appears to be a support or customer service helpline. As the telephone conversation progresses, the fraudsters try to obtain sensitive information such as credit card details or personal information. They will also try to persuade you to disclose verification codes or to accept TWINT payment requests.
Sometimes, they may even ask you to install remote maintenance software, supposedly so that the invoice can be cancelled or a charge reversed. However, the software is designed to give them remote access to your computer. If you then log into your online banking account, the fraudsters can monitor the process and even gain access to the account.
Alleged emails purporting to be from the UBS, TWINT, Migros, etc.
There are many different types of fraudulent emails in circulation. As well as supposed bank confirmations of unauthorised debit transactions, the fraudsters are increasingly using other senders and scenarios. Last week, for example, the NCSC received reports of numerous fraudulent emails sent in the name of Migros. The emails claimed that the recipients had purchased goods worth more than CHF 765, including a bottle of white wine costing around CHF 250. The alleged invoice was intended to persuade victims to call the telephone number provided. What is striking about this scam is that Migros does not sell alcohol. Nevertheless, the supposedly high amount of money involved is often enough to make the victim feel insecure and call the telephone number provided.
Fake messages sent in the name of TWINT or other well-known payment service providers are also common. Regardless of the sender’s address, the fraudsters' aim is always the same: to get you to call the telephone number provided so that they can pressure or persuade you into disclosing sensitive information or authorising payments.
Deactivating the telephone numbers is difficult
The NCSC currently lacks the official means to persuade providers to deactivate telephone numbers being used for fraudulent purposes. While the NCSC can inform the telephone providers of the measures being taken, the decision to deactivate a number ultimately rests with the provider. However, the latest amendment to the Telecommunications Act will change this. The amendment aims to place greater responsibility on service providers, obliging them to block or deactivate telephone numbers that are being used for fraudulent purposes. However, it is likely to be some time before the relevant legislation comes into force. Until then, you should exercise increased vigilance.
Never call any telephone numbers provided in emails or text messages if you are pressured to do so. If you have any doubts about the authenticity of an invoice, use the direct contact details provided on the official website of the alleged sender – for example, your bank, TWINT, Migros, etc.
Recommendations
- Be wary if you receive emails asking you to do something, particularly to ring back a specific number.
- Furthermore, never allow strangers to access your computer and do not disclose any confidential information such as passwords, credit card details or access codes.
- Cybercriminals deliberately exploit people's fear of losing money. If someone pressures you by phone or email, stop engaging with them immediately.
- If you have been tricked into installing remote access software, uninstall it immediately and change all the passwords that you use on the device concerned.
- If you provided your credit card details, contact your credit card company immediately to have the card blocked.
- If you suffer financial loss, the NCSC recommends reporting it to the police. You can find your nearest police station on the Suisse ePolice website (available in German, French and Italian).