He always bought his train ticket from the machine. Sacha Tür (51) finally wanted to “change”, as she put it. Switch from the ticket machine to the SBB mobile app. Now he regrets my name. “I’ve been a victim of fraud,” Thur says. st. Gallen fell in love with credit card scammers.
Thür signed up for the SBB app last Saturday. The registration process does not cause him any problems – he receives the verification code of the federal railways to his e-mail address. As a result, Thur gets his first ticket. The next email in ten minutes, allegedly again from SBB. “I was invited to participate in a customer satisfaction survey.”
100 franc reward? 350 francs stolen!
He opens the message, clicks on the link, and answers questions, not knowing they are scammers. Thur is asked how often he takes the train. “I thought SBB wanted my feedback on the registration process.” Closing the survey – here is where the surprise begins. SBB is generous – Thür should receive 100 francs for his participation. Now all he has to do is enter his credit card information and the reward will be transferred to his account.
The next day, bad surprise. His bank informs Thur that he is the victim of credit card fraud. 350 francs were deducted from his card. When the scammers try a second time, the bank realizes the situation. “How could this happen to me?”
He is generally very careful and warns the employees in his company to be careful. “I don’t order almost anything online, and if I order it, only with Twint,” says Tür.
The question is: How would scammers know that you signed up for SBB minutes before their email? Is there a data leak on the federal railroads – or is it all just a big, unfortunate coincidence? “I contacted SBB right away, but you run into it,” says Tür. “They should be able to explain to me exactly what happened!”
SBB says so
Facing Blick, SBB doesn’t want to know anything about a data leak: “There is no connection between generating the login information and the suspicious email,” says spokesperson Luana Quinter. Scammers will write to .ch email addresses in bulk, regardless of whether the owners of these addresses have a connection to the supposed sender.
“Our experts closely monitor phishing emails and immediately report new phishing sites to the federal reporting office. We also recommend this procedure to potentially affected customers.” SBB never sends unsolicited emails asking customers to provide or change their password or credit card information.
According to SBB, this was all just a coincidence. Thur is lucky in misfortune. “I’m getting the money back because I took out cyber insurance for my company in the fall.” Yet the anger persists. I hope SBB will react and make it easier to report such incidents.”