Fake emails from the «commercial register» demand a data update – Switzerland's NCSC and police warn companies

The wave starts with an email purporting to come from the Federal Commercial Registry Office (FCRO, known as EHRA in German). According to the case description published on 4 November 2026 by cybercrimepolice.ch, the Swiss police's cybercrime information site (German only), the message claims that changes to the commercial register entry have revealed that the company data on file may be incorrect. Recipients are asked to correct the details within six working days. Those who fail to do so are threatened, according to the email, with administrative measures, temporary deletion of the entry and difficulties with business transactions. In its warning of 6 November 2026, Switzerland's National Cyber Security Centre (NCSC, BACS in German) confirms that it is currently receiving numerous reports regarding this allegedly necessary data update – and states plainly: these are phishing messages.

The greeting is striking: «Grüezi, sehr geehrte Geschäftsleitung» – «Grüezi, dear management». According to cybercrimepolice.ch, the email is explicitly addressed to company management – possibly to reach people with decision-making or administrative responsibility and so lend the request more weight. Anyone who handles the management's post in a small company is meant to treat the message as urgent official business rather than advertising.

The link in the email leads to a website that mimics the Swiss Confederation's online presence and stages the process as an official check. First, you have to enter a reference number. The page then asks for details about yourself, your company and how to contact you. In the next step, your authorisation is supposedly verified by means of your IBAN; the name of your bank is requested as well.

To make it all plausible, the page shows progress indicators, according to the police, and ends with a success message. The individual entries thus appear to be parts of one coherent administrative process – exactly what you would expect from a federal online desk. Anyone who sees the confirmation at the end has no reason to become suspicious, and often only realises much later that the data is in the wrong hands.

Unlike many phishing scams, the fake FCRO page demands no payment and no credit card number. That does not make it any less harmful. According to cybercrimepolice.ch, the data collected could serve as the basis for a later, targeted fraud attempt – by email as spear phishing or by phone as vishing. Anyone who knows a person's name, role, company, phone number, IBAN and bank can address them very convincingly at the next contact.

The police consider it conceivable that in a second wave the scammers will again pose as the FCRO – or as staff of the bank named in the form. They could then demand further sensitive information or a payment, for example on the pretext of completing a check that supposedly failed. The pattern is familiar: first trust is built and knowledge gathered, then the money is taken.

For Swiss SMEs this is no footnote. The Cyber study 2026, which we analysed in (→ Over 35,000 Swiss SMEs hit by serious cyberattacks – and only one in four tests its backups), shows that phishing played a part in roughly a third of the reported incidents and that 6 per cent of the SMEs surveyed were hit by a serious cyberattack in the past three years. Only about a third of companies train their staff regularly. An email that looks like an official letter and is addressed to the management therefore lands at many businesses that are not prepared for it.

The commercial register is a public database. According to the Federal Office of Justice (FOJ), the Federal Commercial Registry Office maintains a central register of companies that is updated daily and made accessible via Zefix, the Central Business Name Index; individual queries are free of charge. Company name, registered office, commercial register number and the names of authorised signatories can therefore be looked up by anyone – including criminals. Whether the current phishing emails contain such details is not clear from the warnings issued by the NCSC and the police. What is clear is that the material for a convincing approach is out in the open.

How this material is misused was described by the NCSC in its weekly review 25/2025 of 24 June 2025. Criminals use publicly available company data, especially from Zefix, to impersonate companies. They specifically look for businesses with little or no online presence – such as small law firms, consultancies or investment companies – and take over the company name, address, commercial register number and the names of the managing directors for deceptively genuine fake identities. They use these to promote fraudulent investments, send fake invoices, run phishing campaigns or win the trust of business partners. The recommendations in the current warning – set up a basic official website, regularly search for your company name online, make your staff aware of scams – come from precisely this article.

Nor is it new that the register works as bait. In its weekly review 34/2022 of 30 August 2022, the NCSC warned of invoices from a «Registerverlag für Wirtschaft Schweiz» that appeared to concern an entry in connection with the Swiss commercial register. All publicly available commercial register data had already been entered in the form, and the letter referred to a domain called «Zeffix» – with two f's. Zefix, however, is spelled with only one ‹f›, the NCSC noted. In reality, the letter was an offer for a meaningless entry.

On its commercial register page (status 9 February 2026), the Federal Office of Justice also points to invoices that give the impression of coming from the FCRO. It is clear: commercial register fees are solely a matter for the cantons, and no federal authority sends invoices for commercial register entries. False invoices can be reported to the State Secretariat for Economic Affairs (SECO). By the time we checked on 9 November 2026, the FOJ had not published a warning of its own about the current phishing email – the warnings come from the NCSC and the police.

Several features give the email away when you put them side by side. There is the greeting «Grüezi, sehr geehrte Geschäftsleitung», which sounds polite but names nobody. There is the deadline of six working days, combined with the threat that the entry will be deleted. Authorities set deadlines, but they do not threaten by email to end your company if you fail to click a link within a week. Time pressure and fear are the classic levers of phishing – they are meant to stop you thinking or asking questions.

The decisive clue is the IBAN. The fake page claims to verify your authorisation by means of your account number. That makes no sense: an IBAN identifies an account, not a person, and certainly not the authority to change a company's entries. Anyone who wants to verify you asks for an identity document or signatures, not your bank details. Add the question about the name of your bank, and it is obvious that the aim is to prepare a matching call or email in that bank's name later on.

The NCSC's general advice is to be cautious if you are contacted unexpectedly, even if the company name, address or registration number appear legitimate at first glance. Verify the sender's identity using an independent source: look up the official phone number or website yourself instead of using the details from the email. Watch out, the NCSC says, for small differences in email addresses – it gives the example info@company-switzerland.com instead of info@company.ch – and for unusual communication styles. Neither the NCSC nor the police have published the sender address used in the current wave, so do not rely on recognising a particular domain.

In practice, the cantons are responsible for the commercial register: according to the Federal Office of Justice, they alone levy the fees, and no federal authority sends invoices for entries. If you are unsure whether something really is wrong with your entry, call your cantonal commercial register office or look up your entry directly in Zefix – both are free and take a few minutes. Under no circumstances should you «update» company data via a link from an email.

If you have merely received the email, the case is simple: according to the NCSC, do not respond and delete the message. cybercrimepolice.ch additionally recommends forwarding the email before deleting it so that the police can document the wave, and otherwise moving it to your junk or spam folder. As a rule, never follow links in emails, text messages or other messages, and never disclose sensitive data without thoroughly checking who is really asking.

If you have entered data, the police advise heightened vigilance: be particularly careful about later emails or calls that build on your details – for instance if someone claims to be the FCRO or your bank and wants to «complete» the process. Watch out for unusual orders, invoices or contract documents in your company's name. Keep the email and screenshots of the website as evidence. In the event of actual misuse or financial loss, contact the cantonal police; the NCSC too recommends filing a report with the cantonal police if you have suffered financial loss.

If you entered your IBAN and bank name, we also recommend informing your bank. It can scrutinise suspicious direct debits or payment orders more closely and will know to expect calls made in its name. This is general advice from DealsScout, not a requirement from the NCSC or the police. Also report the incident to the NCSC: via the office's reporting form or via antiphishing.ch, the NCSC's reporting portal for phishing. On cybercrimepolice.ch you can record the case under «Ereignis melden» (report an incident).

DealsScout's take: this attack targets people, not technology. No password is stolen and no account is hacked – someone voluntarily types company data and an IBAN into a form because it looks like a federal portal. Two-factor authentication (→ Set up 2-Step Verification on your Google Account – prompts, app, key or passkey) and passkeys (→ Set up passkeys – sign in without a password on iPhone, Android and Windows) reliably protect your accounts from takeovers, and they belong in every company. But none of these measures stops an employee from taking an official-looking email at face value. That is why the NCSC focuses on awareness: staff should know that outsiders can pose as an authority, partner or customer, and that an independent check is always allowed. A VPN, incidentally, does not help here – it encrypts your connection, not your decision to enter data on a fake page (→ What is a VPN? How the virtual private network works).