Fake police calls fall 75% after Swiss countermeasures

Reports of fraudulent calls from fake police officers and bank employees in Switzerland fell by 75% in July after federal measures were expanded, SRF reported. The Federal Office for Cyber Security received fewer than 100 reports that month, compared with more than 400 per month before the measures.

Since July, telecommunications providers have also been required to identify calls from abroad to mobile numbers as “unknown” or “anonymous”, as they already do for landline calls. The measure is intended to make recipients more cautious.

Despite the decline in malicious activity, cyberthreats remain at a high level, according to the office’s 2026 half-year report. The Swiss population reported more than 27,000 cyberthreats in the first half of 2026, compared with about 36,000 in the first half of 2025 and just over 29,000 in the second half of that year.

Fraud remains a lucrative mass business, said Florian Schütz of the Federal Office for Cyber Security. Artificial intelligence is helping criminals make their contacts with victims more personal, emotional and technically sophisticated.

Jobseekers were a particular focus in the first half of 2026. Criminals used tailored, fake recruitment processes to target individuals and companies. People in IT and management positions were offered supposed dream jobs or lucrative investment opportunities. The alleged headhunters used manipulative methods to steal cryptocurrency worth millions.

More than 9,000 phishing reports were registered by the office’s antiphishing.ch platform. Voice phishing accounted for most of the reports, with criminals calling or leaving voice messages to obtain sensitive data or money.

Twint phishing has also increased significantly in recent months, including through listings on advertising platforms such as Ricardo and Tutti. The Federal Office for Cyber Security also sees a growing threat to companies through email traffic, as employees receive messages containing malicious attachments or links to dangerous documents.

Operators of critical infrastructure must report cyberattacks to the Federal Office for Cyber Security within 24 hours. The office received 200 such reports in the first half of 2026. Hacking attacks made up the largest category, accounting for about a quarter of the reports, followed by stolen login details and disabled websites.

Cybercriminals used compromised email accounts for further phishing attacks and fraud attempts. Other reported incidents included data leaks and extortion attempts involving malware. A case study of coordinated attacks on Polish energy and industrial companies at the end of 2025 showed that basic weaknesses, including missing multi-factor authentication and reused or standard passwords, could be enough to compromise critical infrastructure.