Fraudsters used a QR code to access four family accounts, including those of their daughters, stealing 22,000 francs in a short time.

Source: https://Tio.ch – online news portal owned by Ticinonline SA

ZURICH – A QR code scammed a 36-year-old mother and defrauded her family of 22,000 francs. It happened just before Christmas, when MS* decided to sell some of her two daughters’ old clothes on Facebook Marketplace.

A few extra pennies can come in handy, especially during the holidays. An interested party contacts her and agrees on a sum of 37.50 francs, so the buyer asks if they can pay via the online bank “Revolut.” But since M. has no experience with this payment method, the buyer offers to have someone from “Revolut” contact her to explain how to proceed.

The next day, a man claiming to be a Revolut employee contacted her via WhatsApp. He told her to log in to her online banking as usual and scan a QR code he allegedly sent her via WhatsApp. This, according to the self-proclaimed professional, would allow Revolut to process the transfer. The incoming payment would then be confirmed via the Access app.

The bank employee immediately recognized the fraud: “Around 22,000 francs were withdrawn.” M.’s private and family accounts, as well as her daughters’ two savings accounts, were particularly affected. The scammers first withdrew 37.50 francs from all four accounts, and then about 4,000 francs in several instalments, the 36-year-old explains. The money was then immediately transferred abroad. As for the possibility of recovering the stolen money, the UBS employee explains that the chances of restitution are very slim.

The exact technical context of the scam is difficult to determine, says cybersecurity expert Marc Ruef. But in this case, the QR code likely allowed the scammers to access M.’s e-banking account.

“I see it as a security vulnerability.” In addition to her concern, the 36-year-old is now also plagued by a sense of shame: “I know it’s my fault.” M. had no choice but to file a complaint against unknown persons. And although some names and addresses linked to France, Italy, and Switzerland were subsequently found on M.’s bank statements, the police were unable to help her.

“I’m very angry with myself, but also with UBS,” says M. “The fact that the scammers succeeded is a security breach.” For the past two months, the family—now in financial difficulty—has been keeping afloat with the money left in the woman’s husband’s father’s private account. But household items have also been sold to pay bills.

UBS declines to comment on the case
. After a request for information, UBS declined to comment on specific cases. The bank itself generally advises its clients to be cautious of text messages or phone calls and not to scan unknown QR codes.

But the thing that’s most painful for the woman now is that her daughters’ savings accounts have also been drained. “It’s not their fault at all. My husband and I want to repay the children’s money first.”