Can you spot the scam?

That was phishing.

The warning signs

• Sender domain “swissparcel-paket.info” — a real parcel service writes from its main domain, not from a throwaway domain.
• Time pressure (“within 24 hours”) is the most common lever in phishing.
• The tiny amount is the bait: it is not about CHF 2.99, it is about your card details on the fake payment page.
• Generic greeting — your parcel service knows your name.

This message was genuine.

How you can tell

• Sender domain matches the company and the existing customer relationship.
• Personal greeting and correct contract details (product, amount, invoice number).
• No login link, no time pressure — the invoice sits in the account you open yourself.
• Expected context: the annual invoice arrives around this time every year.

That was phishing.

The warning signs

• Fear plus deadline (“permanently locked”, “24 hours”) — legitimate providers do not lock accounts on a countdown.
• The domain “nimbus-account-verify.com” does not belong to the provider — extra words like “verify” or “secure” in a domain are a classic.
• Logging in via the mail link instead of the app or your bookmark — exactly how credentials end up with the attacker.
• Technical-sounding details (an IP address) are there to fake competence.

That was phishing.

The warning signs

• The “boss” suddenly writes from a private Gmail address instead of the company domain.
• The combination of urgency, secrecy (“discreet”) and unavailability — the classic CEO-fraud pattern.
• Gift cards are popular with fraudsters: anonymous, instantly redeemable, impossible to charge back.
• “Mail only” prevents the one phone call that would expose the scam.

That was phishing.

The warning signs

• Authorities never ask for bank details via an SMS link — refunds are handled through your tax return.
• The “.top” domain has nothing to do with the administration (real authorities: admin.ch).
• The sender is an ordinary mobile number.
• A specific amount looks credible — it is the same for every recipient.

This message was genuine.

How you can tell

• Pure information: no link, no attachment, no request to enter anything.
• Internal sender domain that matches the company.
• No artificial time pressure — just an announced, planned event.
• Questions go through a known, independent channel (the internal number).

This message was genuine.

How you can tell

• Expected context: you actually booked this appointment.
• No link, no request for data, no payment demand.
• Contact via an official phone number you can verify independently.
• Missing context would be THE signal the other way round: an appointment reminder without a booked appointment is bait.

That was phishing.

The warning signs

• A ZIP attachment from an unknown sender — the standard vehicle for malware, because mail filters inspect its contents poorly.
• No reference to a specific position or where it was advertised — mass mailing.
• The context feels harmless and everyday — exactly what this scam relies on: HR inboxes HAVE to open attachments.
• Legitimate applications arrive as PDFs these days, not as ZIPs.