Seven scams hitting Swiss SMEs in 2026, and how to spot them

Fraud is the most common cyber offence in Switzerland. In the second half of 2025 the Federal Office for Cyber Security (BACS) received 29,006 reports, 52 percent of them about fraud (BACS, semi-annual report 2025/2). In the first half of 2026 there were 27,128 reports, and fraud still dominates (BACS, semi-annual reports).

I look after finance at our company. I see every invoice before it is paid. So here are the seven scams that hit small businesses most often in 2026, and how to spot them.

1. CEO fraud, now with an AI voice

An e-mail «from the boss»: urgent, confidential, a transfer or gift cards. The boss is in a meeting and cannot be reached.

In 2025, 971 cases were reported to BACS, after 719 the year before (BACS, week 4/2026). The scammers read the website, LinkedIn and the commercial register first. What is new is the voice: about ten seconds of recording are enough to clone one (BACS, week 31/2026).

• How to spot it: pressure plus payment plus «please don't call».
• What to do: call back on the number you know. Never by replying to the message.

2. The real invoice with the wrong IBAN

An invoice you expect arrives again. Amount, logo and invoice number are right. Only the IBAN is new, often with a matching QR code, and a short reason: «We have changed banks.»

Usually there is a hacked mailbox at the supplier behind it (BACS, business e-mail compromise).

• How to spot it: new bank details, announced by e-mail.
• What to do: never change bank details because of a message. Call the supplier on the known number.

3. The invoice in a ZIP attachment

An e-mail with a supposed invoice number and a ZIP file attached, containing an HTML file. It shows a harmless old e-mail thread. In the background it loads malicious code (BACS, week 11/2026).

• How to spot it: an invoice that matches no order, packed in a ZIP.
• What to do: don't open it. Real invoices arrive as PDFs from senders you know.

4. The fake bank call

«This is your bank's security department. There were suspicious payments on your account.» Then you are asked to install remote support such as AnyDesk, give login details or withdraw and hand over cash.

The cantonal police of St. Gallen warned about it in June 2026 (St. Gallen cantonal police), Graubünden in August (Graubünden cantonal police). Their rule is short: no bank, authority or police asks for passwords, codes or cash by phone.

• How to spot it: a call that frightens you and then asks for something.
• What to do: hang up. Call the bank yourself on the number on your card.

5. The parcel waiting for a few francs

A text or e-mail in the name of Swiss Post, DHL or DPD: a parcel is held, a small fee is missing. Whoever pays on the fake page gives away their card details. Shortly after, a fake bank often calls and wants to stop the «fraud case» with a code. BACS calls this «double phishing» (BACS, week 18/2026).

• How to spot it: a small amount, a link, a deadline.
• What to do: don't click. Check parcels only in the app or on the carrier's site, typed in yourself.

6. The yellow slip in the letterbox

The same scam on paper: a pick-up notice that looks like Swiss Post's, with a QR code for a «new delivery». The code leads to a fake page that wants your details and your card (BACS, week 24/2026).

• How to spot it: a QR code that leads to a payment or card details.
• What to do: type the tracking number into post.ch yourself instead of scanning the code.

7. «Your domain expires»

A «registration office» writes that someone wants to register your company name as a domain, or that your domain will be deleted. Pay at once or lose it. The scam has been around for years and mainly targets companies and associations (BACS, week 21/2024).

• How to spot it: a provider you don't know, and a deadline.
• What to do: renew your domain only with the provider you know.

All seven scams want the same thing: that you pay quickly, click or give a code. Whoever waits ten minutes and calls back themselves almost always wins.

If it has already happened

• Call your bank at once on the official number. Sometimes the payment can still be stopped.
• Report the case to BACS and, if you lost money, to the police, in an emergency on 117.
• If you gave a password or installed remote support: change passwords, have the device checked.

What we do about it

Our colleagues, including our customers' Betriebs-Assistent, never ask for passwords, card or bank details or one-time codes. They never change bank details because of a message. If something looks like fraud, they warn the owner in one line and never answer it by themselves.

The seven rules are also available as a sheet to print: How to protect your business from fraud.