How to spot phishing emails: examples from Switzerland and what to do next

You can spot a phishing email mainly by three things: the sender address does not match the supposed sender, the link leads to an unrelated domain, and you are pressured to pay something or enter login details. The safest rule is: do not act via the link in the email, but open the provider’s app or website yourself. Anything not shown there is very likely fake.

Typical phishing scams in Switzerland

Fraudsters like to pose as senders people deal with regularly anyway. In Switzerland, these patterns keep coming back:

Post, parcels and customs fees

A parcel has supposedly been held back, delivery failed or customs or storage fees are still outstanding, often just a few francs. The link leads to a fake page that steals card details. According to Swiss Post, it never asks for passwords, security codes or full credit card details by text message or email.

Banks and credit cards

Your account is about to be blocked, a payment must be confirmed or your details need updating. Often a phone call follows in which someone poses as a bank employee in flawless Swiss German. No bank asks for passwords or card confirmation by email. Only open e-banking via the app or an address you type in yourself.

Domain renewal and listing services

Domain holders receive emails or letters that look like a renewal invoice: your .ch domain is about to expire, and several hundred francs are due for registration or a “listing service”, payable to a foreign account. Cantonal police regularly warn about such alleged domain invoices. Only renew your domain with the registrar where it is registered; any WHOIS lookup shows you which one.

Hosting invoice and full mailbox

A payment supposedly failed and your website will be suspended, or your mailbox is full and messages are being held back. The link leads to a fake login page for webmail or the client area. Always check open invoices directly in your provider’s client area.

Checking the sender

The display name of an email can be anything. What matters is the address behind it, especially the domain after the @ sign. Tap or click the name to see the full address.

• Unrelated domain: the name says “Swiss Post”, but the address ends in @parcel-delivery.info or @gmail.com.
• Similar domain: swapped or added characters such as p0st.ch, post-ch.com or your-bank-security.ch.
• Different reply-to address: replies go to an address other than the sender’s.
• Impersonal greeting such as “Dear customer”, although the real provider knows your name.

If you want to dig deeper, open the email headers (in many programs “Show original” or “View source”). “Authentication-Results” shows whether SPF, DKIM and DMARC passed. A “fail” on an email supposedly from your bank is a clear red flag. Conversely, a “pass” only means the email really comes from the domain shown, not that this domain is trustworthy.

Checking links without clicking

On a computer, hover over the link and wait until the destination appears at the bottom of the window. On a smartphone, press and hold the link until the preview appears. Then read the domain from right to left, starting at the first single slash:

Be careful with QR codes in emails or letters too: they hide the address just as well. And a padlock in the address bar only means the connection is encrypted. Phishing sites use HTTPS too.

Tip: Create bookmarks for your bank, the post, taxes and your hosting provider, or use the official apps. Then you never need to follow a link from an email.

More warning signs

• Time pressure: “within 24 hours”, “final reminder”, “your account will be deleted”.
• Unexpected attachments, especially ZIP, HTML or Office files with macros.
• Amount or invoice number does not match any invoice in your customer account.
• Requests to change bank details or pay to a new IBAN.
• Spelling mistakes, mixed languages or an unusual sending time.

Clicked or entered data: what now?

If you only clicked the link but entered and downloaded nothing, there is usually no damage. Close the page. If you entered data or opened an attachment, act immediately:

1. Change the password of the affected account and everywhere you use the same password. If it concerns your email account, also change the passwords of services linked to that address.
2. If you entered card or bank details, call your bank or card issuer immediately and have the card blocked.
3. Enable two-factor authentication wherever it is still missing.
4. Look for unknown forwarding and filter rules in your email account and delete them.
5. If you opened an attachment or installed a program, disconnect the device from the network and have it checked. If a remote access program was installed, uninstall it.
6. If financial damage occurred, report it to the police, for example via Suisse ePolice or at a police station.

Reporting phishing

Reports help to block fake sites faster. The Federal Office for Cybersecurity, known until the end of 2023 as the National Cyber Security Centre (NCSC), runs the antiphishing.ch site for this:

• Forward phishing emails without comment to reports@antiphishing.ch. The mailbox is processed automatically and you will not receive a reply.
• Report phishing websites using the form on antiphishing.ch.
• If you want a reply or need to report another incident, use the Federal Office for Cybersecurity’s reporting form.
• Also inform the company in whose name the email was sent. Many have their own reporting address.

Then you can delete the email. Never reply to a phishing email; that only confirms your address is active.

For businesses: SPF, DKIM and DMARC

Phishing does not only target your staff. Fraudsters also send emails in your company’s name, for example fake invoices to your customers. Three DNS records for your domain help against this:

• SPF defines which servers may send email for your domain.
• DKIM signs outgoing emails so recipients can check that they come unchanged from you.
• DMARC tells receiving servers what to do with emails that have neither a valid SPF nor DKIM aligned with the sender domain: just monitor (none), send to spam (quarantine) or reject (reject).

Only with DMARC set to quarantine or reject does it become difficult for fraudsters to deliver emails with exactly your sender domain. The records do not help against fakes using similar domains such as your-company-ch.com. That is why a few organisational rules belong to good protection: always confirm changes to bank details by phone using a known number, approve payments under the four-eyes principle and regularly brief staff on current scams. Our guide to SPF, DKIM and DMARC shows how to set up the records step by step.

Tip: Start DMARC with p=none and a reporting address. The reports show which services send in your name. Only once all legitimate senders are properly set up should you tighten it to quarantine and reject.

With HostOn’s email plans, DKIM, SPF and DMARC are prepared, and incoming messages are checked by Rspamd for spam and by ClamAV for viruses. How to recognise genuine messages from HostOn is explained on our phishing warnings page.