What the authorities see. Official figures.
- 27,128reports received by the Federal Office for Cybersecurity in the first half of 2026Federal Office for Cybersecurity, report 2026/I
- +35%more CEO fraud cases reported in 2025 than in 2024 (971 against 719)Federal Office for Cybersecurity, week 4, January 2026
- 61%of the population received a phishing message in three months (2025)Federal Statistical Office, December 2025
Show the table
| Period | Reports |
|---|---|
| H1 2024 | 285 (calculated from the published totals) |
| H2 2024 | 434 (calculated from the published totals) |
| H1 2025 | 605 |
| H2 2025 | 366 |
| H1 2026 | 258 |
Source: Federal Office for Cybersecurity, half-year reports 2024 to 2026. The drop in 2026 does not mean less risk: the Federal Office for Cybersecurity sees rarer but more polished attacks, using AI.
Seven risks. Explained simply.
- 1Data leaving unseen
Someone pastes a contract or a client list into a free tool to save time. The data leaves the organisation.
A factIn Switzerland, more than half of the people who use AI at work say they do so against internal rules. Netzwoche, KPMG study, May 2025
What protectsA business tool under contract, a list of what you never paste, a one-page usage policy.
- 2Instructions hidden in an e-mail or a document
AI cannot tell your instructions from the text it reads. An instruction hidden in an e-mail or a PDF can hijack it.
A factIt is the number one risk in the OWASP 2025 ranking for AI applications. OWASP, Top 10 LLM 2025
What protectsLimited rights for the assistant, and human approval before any action.
- 3Rigged agents and connectors
An agent reads your e-mails, opens your files, sends messages. If its “plug” into a tool is rigged, it works for someone else.
A factIn 2025, a fake e-mail connector quietly copied an attacker on every e-mail sent. The Register, September 2025
What protectsA list of approved connectors, minimal rights, no autonomous agent on a computer that holds client data.
- 4Made-up answers, given with confidence
AI sometimes invents a figure, a reference or a quote. The danger is not checking.
A factIn 2025, a German court criticised a lawyer for citing fake rulings produced by a chatbot. beck-aktuell, September 2025
What protectsEverything that goes out is checked by a person, and every figure has a verified source.
- 5Fake e-mails without a single mistake
Fake e-mails quote your name, your job, a real project, in flawless language.
A factThe Federal Office for Cybersecurity notes that fraudsters now use AI systematically for tailored messages. Federal Office for Cybersecurity, half-year report 2026/I
What protectsExternal e-mails marked as such, wariness of urgency, two-factor authentication everywhere.
- 6A faked voice or video
A call or a video call imitates the voice and face of the boss, a partner or the banker, to get an urgent transfer.
A factIn January 2026, a company in the canton of Schwyz lost several million francs to a voice imitated by AI. Schwyz cantonal police, January 2026
What protectsNever decide on a voice or an image: call back on a known number, and two signatures to pay.
- 7Stolen accounts and keys
An AI account holds the history of your conversations. An access key lets someone use AI at your expense.
A factIn 2025, more than a million keys linked to AI services leaked on public code repositories. GitGuardian, 2026 report
What protectsTwo-factor authentication, a vault for keys, a spending cap, fast revocation.
19 actions. In three stages.
Tick what is done at your place. Your ticks stay in this browser, nothing is sent.
This week
This month
This quarter
A suspicious voice on the phone. The protocol.
CEO fraud with a fake voice, what is called a voice deepfake: someone imitates a manager’s voice on the phone, or by video, to get an urgent transfer. The defence fits in one rule: never pay on the strength of a voice; hang up and call back.
Before
- Two signatures for any payment or IBAN change, even for management.
- An up-to-date list of trusted numbers: management, bank, main suppliers.
- A check question agreed between managers and signatories.
- Fewer public details about the organisation and its direct contacts.
During the call
- Spot the signals: urgency, secrecy, a bypassed procedure, a new number, a new account, a foreign country.
- Do not trust the voice or the face, even if they seem right.
- Say: “I have to follow our procedure, I will call you back.” Then hang up.
- Call back on the trusted number, and have the second person approve.
- Install no software and give no code when a caller asks.
After a doubt
- Call the bank straight away to try to stop the transfer.
- Keep the evidence: numbers, messages, screenshots. Do not share the fake video again.
- File a complaint with the police and report the incident to the Federal Office for Cybersecurity.
- Warn colleagues: fraudsters often contact several people.
Sources: Federal Office for Cybersecurity, Schwyz cantonal police, Swiss Crime Prevention. The check question is not an official Swiss recommendation: it is adapted from good business practice.
