Fake SBB emails – How do card issuers catch perpetrators?

Phishing emails with the SBB logo are currently going around. The Swiss-German consumer magazine Espresso from Swiss Radio SRF 1 reported on such a case on 25 May 2023. We spoke to Patrick Dessouslavy, Head Operations Risk Management at Viseca, to find out how Viseca manages to uncover such fraud.

Journalist Martina Schnyder from the consumer magazine Espresso from Radio SRF1 gave an impressive portrait of a card fraud victim who fell for all the traps set by the perpetrators: Link

Although the victim suffered financial losses, the quick action of card provider Viseca prevented the worst from happening. We want to find out from Patrick Dessouslavy, Head Operations Risk Management at Viseca, how one gets on the trail of such perpetrators.

In the example described, the customer himself triggered the transactions. How do you still manage to determine that something isn’t quite right?
The security of our payment cards is a top priority for Viseca. Extensive combating of fraud is just as important. State-of-the-art early warning systems with comprehensive prevention rules, which are adjusted daily as needed, help us to detect a large part of fraudulent transactions during the authorisation process and reject them accordingly.

Have such fraudulent transactions increased in recent years?
It is more the case that the nature of fraudulent transactions has shifted due to constant digitalisation. This is why we are seeing more fraud online today than in the past. We have seen a strong increase in phishing in particular in recent years.

What scale are we talking about here?
We are in the per mille range.

And how many such transactions can you prevent?
A number of confirmed fraudulent transactions many times over

What advice do you give your clients?
We advise clients to be attentive at all times. Fraudsters’ approaches are becoming more and more sophisticated, whether phishing by email, smishing by SMS or vishing by phone. When receiving messages (email, SMS, telephone), important rules must be observed in order to protect sensitive data (including payment card data) from unauthorised access:

Before clicking on a link or providing card data, users should take a careful look at the email or website in question. General greetings, spelling mistakes or bait offers often indicate phishing. One should be particularly careful if the message claims to be urgent. Generally, you should only react if you are absolutely sure that the email or SMS is genuine or comes from an official sender. If in doubt, the sender can also be contacted on another channel.

If the card has been misused, the card issuer should be contacted as soon as possible and the card frozen immediately. Furthermore, it is important that payment card statements are checked immediately upon receipt and that incorrect or fraudulent withdrawals are reported to the relevant card issuer within 30 days.