21.10.2025 - The NCSC regularly receives reports of phishing emails targeting TWINT users. These scams aim to steal credit card details or take over TWINT accounts – and not all of them rely on phishing websites. One recent case, which looked harmless at first but turned out to be carefully planned, involved a personal message and an early-morning money request designed to catch people off guard.
The NCSC is familiar with scams that use TWINT; incidents involving online classifieds or fake payment requests are reported regularly. Just last week, the NCSC observed fraudulent emails to TWINT customers claiming that their accounts needed to be verified and their personal details confirmed to avoid being blocked. What made these emails stand out was that they were personalised – the victims were addressed by their full names, and even their home addresses were included. However, the dataset used by the scammers appeared to be outdated, as some of the addresses were no longer current.
When victims clicked on the link to confirm their details, they were taken to a page where they had to answer a few inconsequential questions before being asked to provide their credit card details to receive a supposed refund.
The phishing site had nothing to do with account verification or the TWINT account itself. While the phishing email appeared professional and well-designed, the scammers seemed to run out of steam when it came to creating the fake website. It looked as though they had cobbled it together half-asleep, which leads us straight to the second case.
Greater success early in the morning
A second case shows that scams can be pulled off with even less effort: one morning, still half-asleep, someone received a TWINT notification. The accompanying message read politely: "Here's the money I owe you." It sounded plausible – they'd been out with friends the night before, and people had been buying rounds. Still drowsy, they clicked the button, thinking they would receive money. Instead, the amount was debited from their account. It only became clear later that the TWINT transaction had actually been a payment request – deceptively worded and disguised as a supposed payment. The scammers were clearly counting on a moment of inattention: when you're not fully awake, you're less likely to check the details, especially if the message looks trustworthy. By deliberately phrasing it as if it came from someone they knew settling a small debt, the scammers made the message sound credible – prompting a hasty click. Scammers exploit the fact that many people generally trust TWINT messages, particularly when the message suggests a personal connection (for example, "Here's what I owe you").
Recommendations
- TWINT payments come in automatically, so there's no need for you to confirm or take any further action.
- Always check payment requests carefully. Look at the amount, the recipient, and type of transaction.
- Be especially vigilant with notifications at unusual times, such as when you first wake up or when you're under time pressure.
- Don't rely on the message text alone. Scammers can write whatever they like, and this does not guarantee that the payment is genuine.
- If something doesn't feel right, double check. Contact the supposed sender via a different channel before confirming anything.
- Inform the TWINT customer service department of your bank. You can find the contact details for the relevant bank on the TWINT website.
- Report the incident to the police if you have been the victim of such fraud. You can search for police stations in your area on the Suisse ePolice website.
Current statistics
Last week's reports by category:
Last modification 21.10.2025
