28.04.2026 - The National Cyber Security Centre (NCSC) has once again received a high volume of reports concerning "Hi Mum/Dad" scams. A notable trend this week is that scammers are almost exclusively using Apple's iMessage service to contact people. They often use foreign country codes or iCloud email addresses, and in some cases they even write in Swiss German.
The "Hi Mum/Dad, my phone is broken" scam is nothing new, but unfortunately it remains a popular tool for cybercriminals. In this type of scam, you receive a message from an unknown number. The sender claims to be your son or daughter, saying that they broke or lost their old phone and can now be reached on this new number. Once you have saved the new number and replied, you soon receive a request for money. The message usually says that the banking app isn't working on the new phone yet and that an urgent bill needs to be paid.
Special approach: Account takeover
In one reported case, a scammer impersonated someone the victim knows, and claimed that their smartphone had been locked. The scammer said that customer service had told them an activation code was required to unlock it, and that this code had to be provided by another person. The scammer added that the victim was the only person currently online who could help.
The victim was then instructed to enter a code in the TWINT app, which triggered a payment. The scammer then claimed that the victim would receive a PIN by text message and asked them to forward it so the phone could be unlocked. The victim stopped communication at this point. The NCSC assumes that the code was in fact intended to activate the TWINT account on another device.
iMessage as the preferred channel
While these messages were previously often sent as text messages or via WhatsApp, reports to the NCSC show that there has been a clear shift towards iMessage (recognisable on Apple devices by the blue message bubbles).
This offers scammers several advantages: iMessages sent over the internet are free and not subject to the same spam filters as regular text messages sent via mobile network providers. Furthermore, only an Apple ID is required to send iMessages.
Foreign country codes and Swiss German
A notable feature of the current wave is the type of sender used.
- Messages almost always come from numbers with foreign country codes – very often from the Philippines (+63) or Morocco (+212).
- iMessages, however, are sent using iCloud email addresses (e.g. firstname.surname@icloud.com).
- Despite these suspicious sender details, scammers sometimes write their messages in Swiss German to build trust (e.g. "Hoi Papi, mis Handy isch kaputt…").
Recommendations
- If you have suffered a financial loss, we recommend that you report it to the police. You can find your nearest police station on the Suisse ePolice website (available in German, French and Italian).
- Be cautious of unsolicited text messages.
- Never share your security codes or passwords, even if you think you know the person asking for them.
- Call your child using the number you already have saved.
- Agree in advance on a question that only your child would know the answer to.
- Never transfer money to unknown accounts, even if the situation is presented as urgent.
- Block the sender immediately. In iMessage, you can report such messages directly in the app using the "Report spam" (or "Report junk") function.
- Make sure your family members are aware of this type of scam.
Further information
Cybercrimepolice.ch: Vorsicht vor «Hallo Mama hier meine neue Nummer» (available in German)
Current statistics
Last week's reports by category:
Last modification 28.04.2026
