What happens after a phishing report in Switzerland

Every year, Switzerland's Federal Office for Cybersecurity (OFCS) receives around one million phishing reports through the website antiphishing.ch. Given this volume, an artificial intelligence system first analyses the reports. Suspicious cases are then filtered and passed on to a staff member, who makes the final call on whether it is actually phishing. That is according to Roman Hüssy, co-head of GovCERT, the OFCS unit responsible for the matter.

The OFCS does not carry out investigations itself: identifying the perpetrators is the task of criminal prosecution authorities. If the office comes across information useful for tracing those responsible or identifying potential victims, it passes it on to the competent bodies.

When a phishing site is identified, the OFCS reports it to internet service providers, in Switzerland and abroad, so they can block it. It also warns companies whose name is being misused by scammers, so they can alert their customers. The federal office, however, has no power to enforce these measures. Alongside this work, it carries out prevention and awareness activities, informing the public and businesses about current threats.

A fight against short-lived sites

Hüssy acknowledges that the question of how effective these measures are is a fair one. The problem, he explains, is that phishing sites are often disposable: once one is blocked, another quickly appears. The main difficulty remains identifying those responsible, who often operate from abroad. Tracking them down requires significant resources from criminal prosecution authorities, and international cooperation can be complicated with certain countries.

For the OFCS, it remains essential to identify phishing sites as quickly as possible: every site blocked, Hüssy says, means fewer potential victims. Taking down a single page does not solve the problem at its root, but reports help limit the damage and protect more users.

Anyone caught out by phishing is advised to file a police report. Victims should also block any affected bank accounts, credit cards or other compromised services as quickly as possible. Suspicious sites or messages can also be reported to specialised platforms such as cybercrimepolice.ch, since the OFCS cannot conduct criminal investigations directly.