On 20 October 2026, the Federal Office for Cybersecurity (FOCS), the Confederation's centre of expertise, reported a new scam targeting TWINT, the Swiss mobile payment app. Fraudsters are trying to take over TWINT accounts through phishing linked to hotel bookings. Their methods resemble those of classified-ad phishing, the office notes. The authorities and the companies targeted give concrete signs for spotting these traps, and the FOCS sets out the steps to take afterwards.
This page deals with scams only. Installing the app and using it day to day are described in our page on how TWINT works.
TWINT is part of everyday life, in shops as well as online. According to its website, 4 out of 5 shops and more than 84% of online shops in Switzerland accept it. The app is also used between private individuals: it lets you "send and request money or split bills", according to the same page.
Which TWINT scams are being reported in Switzerland?
The alerts published in October 2026 point to five families of traps. Not all of them name TWINT: the table presents them as dated examples.
| Trap | Dated example | What should raise suspicion | Source |
|---|---|---|---|
| Phishing linked to hotel bookings | 20 October 2026 | Fraudsters now target TWINT and e-banking accounts, not just credit cards | FOCS |
| Fake WhatsApp messages with real data | October 2026, TCS Camping customers | A link or a payment request via WhatsApp, which TCS Camping does not send | TCS, quoted by ICTjournal |
| Fake login alert | 14 October 2026, in the name of PostFinance | A message urging you to log in via a link | SCP |
| Fake refund | 21 October 2026, in the name of the British finance ministry | A promise of money to be received | SCP |
| Fake "Swiss" shop | 13 October 2026 | A .ch domain and a local story, but a legal notice abroad and a warehouse in Asia | FOCS |
The two alerts from Swiss Crime Prevention (SCP) appear on its website skppsc.ch, in its list of warnings. The first imitates PostFinance, Swiss Post's financial institution. The second claims to come from HM Treasury and promises a refund.
TWINT scam on a classified ad: what do we know?
Classified-ad phishing is a method the FOCS knows well: the office uses it as a point of comparison to describe the variant of 20 October 2026. The summary published on its homepage does not detail how it unfolds step by step. We therefore do not reconstruct it here.
One point follows from the description of the app itself. According to TWINT, the "Between friends" feature is used to send money, but also to request it. Our analysis: a request received in the app invites the person receiving it to pay. A seller waiting for money from a buyer has nothing to pay. A request that arrives at that moment should therefore stop them in their tracks.
The same caution applies at the checkout. TWINT describes a simple gesture there: scan the QR code, then confirm the payment. Our analysis: every confirmation in the app commits money, and deserves to be read before it is approved.
Why does a fake message seem so credible?
Some fraudsters use real information. The case of TCS Camping, the camping arm of the Touring Club Switzerland (TCS), shows this. Data on its customers was stolen from Camping.care, the provider that manages its bookings. According to the IT magazine ICTjournal, on 27 October 2026 some 15,000 customers were warned of fraud attempts on WhatsApp.
According to the TCS letter quoted by ICTjournal, the fake messages reuse real names, phone numbers and booking numbers. Bank details and IBANs are not affected, according to the TCS. The Hüttenberg campsite, in Thurgau, is also warning its customers about similar messages. 2clics covered the affair in detail in its article "TCS Camping: data leak and fake WhatsApp messages".
What people publish themselves also feeds these scams. The FOCS devoted its Cyber Security Month 2026 to sharing too much information, known as "oversharing". According to the office, a photo, a place or a name seem harmless taken in isolation. Combined, they paint a precise portrait "that a criminal can exploit in a targeted way".
How can you spot a TWINT scam before paying?
The sources consulted give several concrete signs. None is enough on its own, but each is a reason to stop:
- a link or a payment request received by messaging app in the name of a company; TCS Camping, for example, sends neither links nor payment requests via WhatsApp;
- a message that cites a real booking: the TCS warns that the stolen data may be used for new phishing attempts; our analysis: knowing this number does not prove the sender's identity;
- a login alert with a link: the FOCS advises never to click, but to type the service's address yourself;
- an unexpected promise of a refund, like the one in the fake email reported by the SCP on 21 October 2026;
- a TWINT money request received when you are the one expecting a payment;
- a shop that calls itself Swiss: according to the FOCS, a careful look at its legal notice or its terms and conditions sometimes reveals a company based abroad.
What should you do if you have been caught out on TWINT?
You need to act straight away. The FOCS points this out on its page "What to do if your account has been hacked or your data leaked?": the theft is often discovered when it is already too late. The office sets out the steps to follow there:
- for a bank account or a financial service, contact the provider immediately;
- change the password at once, if the account can still be accessed;
- enable two-factor authentication wherever possible;
- update the operating system and apps, then run an antivirus scan;
- have your cards blocked and check your statements;
- file a complaint with the cantonal police in the event of financial loss.
On the TWINT side, the homepage refers users to the FAQ, then to the chatbot and the customer service in the app. The FAQ notably covers the case of an automated payment that the user disputes. The homepage consulted says nothing about a payment confirmed as a result of deception.
Reporting to the FOCS remains useful, even after the fact. The office receives voluntary reports of cyber incidents from the public, and helps people take the necessary steps, according to its website.
How can you better protect your account in advance?
Spotting an intrusion early helps to stop it, according to the FOCS. The office advises keeping an eye on logins made from unusual places or at unusual times; Apple, Google or Microsoft send a notification in such cases. On 19 October 2026, the office also published a classification of login methods into five levels, from "low" to "high". According to the 2clics report, this is not a certification, but a reference for choosing a solution.
Merchants who accept TWINT payments have other questions, mainly about cost: these are covered in our page on TWINT fees for merchants. Other means of payment are covered in our section on digital payments in Switzerland.
Key figures
- 15,000 TCS Camping customers warned of fraud attempts on WhatsApp, according to ICTjournal on 27 October 2026;
- 4 out of 5 shops and more than 84% of online shops in Switzerland accept TWINT, according to the TWINT website;
- 5 levels in the classification of authentication methods published by the FOCS on 19 October 2026.
What we do not know yet
- the number of victims of TWINT scams in Switzerland: the FOCS summary of 20 October 2026 does not put a figure on it;
- exactly how classified-ad phishing unfolds, which the pages consulted name without describing it;
- whether TWINT or the banks refund a payment confirmed to a fraudster: the sources consulted do not say;
- the app's technical safeguards, such as the code or biometrics required to pay;
- TWINT's own security advice, which is absent from its homepage.
Sources
- Federal Office for Cybersecurity, FOCS homepage and news, including "Week 42: TWINT accounts targeted by a new phishing variant linked to hotel bookings" (20 October 2026), "Week 41: When the reference to Switzerland is misleading" (13 October 2026) and "Cyber Security Month 2026: 'Oversharing'" (5 October 2026)
- Swiss Crime Prevention, skppsc.ch homepage, alerts of 14 and 21 October 2026
- TWINT, private customers homepage, consulted on 30 October 2026
- ICTjournal, "PHP2Shell: des escrocs ciblent les campeurs suisses", 27 October 2026, quoted by 2clics.com in "TCS Camping: data leak and fake WhatsApp messages"
- Federal Office for Cybersecurity, "What to do if your account has been hacked or your data leaked?" and "Five steps to secure authentication" (19 October 2026), quoted by 2clics.com in "Online fraud: AI-boosted antidetect browsers" and "TWINT: how the Swiss payment app works"
