23.12.2025 - Christmas is considered a time of hope and reflection, and this is precisely what fraudsters who pose as alleged helpers are counting on. They tell victims who have lost money through online investment fraud, for example, the good news that these lost funds have 'reappeared'. But the miracle never happens. Instead of a refund, victims are presented with bills, and are pressured to pay various 'service fees' until it becomes clear that the promised refund will never materialise. This is how the promised Christmas miracle turns out to be fraud.
The NCSC is currently receiving an increasing number of reports from individuals who have already fallen victim to online investment fraud and who are now being promised that the money they lost has been found. The perpetrators often act professionally, presenting forged documents and convincing stories to feign credibility. It is difficult for victims to recognise the deception since they have just lost money through a previous scam and are now clutching at straws to get it back. While the NCSC received 91 reports of fake recovery scams last year, this year there have already been 462 reports. Apparently, the business of preying on the hopes of those who have already been scammed is booming.
If a victim falls for an online investment scam, it is usually only a matter of time before a fictitious authority, a 'law firm', a company or some other organisation contacts them, claiming to have found the lost funds. In many cases, the names of international law enforcement agencies such as Europol or Interpol are misused. Fraudsters have even posed as alleged NCSC employees in these scams. The NCSC has reported on this in its Weekly Review 38.
The Cyprus Securities and Exchange Commission is also popular with fraudsters. The NCSC has received several reports of fraudsters posing as representatives of this authority. The fraudsters register official-looking email addresses and pretend to be real people who are listed and certified on the websites of the Cypriot authorities. The Cypriot authority has since responded and deactivated the page containing the employees' details.
The Swiss Financial Market Supervisory Authority (FINMA) has also been used as bait for such alleged refunds. In one case reported to the NCSC, it is alleged that assets have appeared on platforms used by the victim but cannot be allocated. The victim is asked to contact the ‘team’ to clarify the situation.
Fraudsters also contact victims by telephone
Although most fraud attempts continue to be carried out in writing, the NCSC has recorded an increase in cases this year where perpetrators also contact their victims by telephone. Similar to voice phishing, fraudsters can respond even more specifically to the victim in a direct conversation. This is particularly true if the victim becomes suspicious. However, the biggest obstacle for perpetrators at present is still the language barrier. This is why most calls are made in English. With the increasing use of artificial intelligence and real-time translation, however, a significant rise in such fraud attempts is to be expected in the coming years.
The consequential damage often exceeds the initial damage
The insidious thing about this approach is that the damage caused by the second incident can sometimes be greater than the damage already suffered from the previous online investment fraud. One victim lost CHF 10,000 in an online investment scam in 2023. Two years later, the fraudsters contacted the victim again and offered to ‘recover’ the lost funds for a fee of CHF 22,000. At first glance, it seems illogical that the victim should pay more to recover the funds than they originally invested. However, the trick used by fraudsters is that they do not refer to the actual amount invested, but instead tempt the victim with the supposed profits from the investment. In this case, the amount was CHF 600,000. Sums of this magnitude tempt victims into paying even higher fees. The perpetrators know how to exploit not only hope but also the motivation for high profits for their own purposes. Victims hope not only to get their money back, but also to receive the supposed profits.
Recommendations
- Be extremely cautious of unsolicited emails promising to recover lost money.
- Never make advance payments to get supposedly lost funds back. Reputable organisations will never ask for advance payments.
- Never give callers remote access to your computer.
- Always check the sender’s email address. The NCSC and similar authorities do not use free webmail providers.
- Never reply to these types of emails, or click on links or attachments.
- If you have suffered financial loss, we recommend filing a criminal complaint with your local police station.
Current statistics
Last week's reports by category:
Last modification 23.12.2025
