The vocabulary of an online fraud case
The same words come up in every case — on the phone with the bank, at the police counter, in an investigation report. Here is what they mean exactly, and what they do not mean.
Neutral definitionsOfficial Swiss sourcesNo promise of a result
The glossary in brief
This glossary defines 24 terms used in online fraud cases in Switzerland, grouped into three families: the methods scammers use, the digital and financial traces they leave, and the legal framework and procedures that follow.
- Scope
- 24 terms from online fraud, OSINT, crypto and Swiss law.
- Audience
- Victims, relatives, lawyers and journalists who need to read an investigation file.
- Register
- Neutral definitions, no needless jargon, with the limits of each notion stated.
- Updated
- Reviewed on 20 August 2026 by the editorial lead of ScamHunter.ch.
On this page
Types of online scam
- Investment scamInvestment fraud
- A scheme in which a platform or “advisor” promises high, low-risk returns. Small early withdrawals are sometimes honoured to build trust, then the account freezes, fresh “fees” are demanded and the contact disappears. In Switzerland, FINMA publishes a warning list of unauthorised actors.
- Romance scamAffinity fraud
- An online relationship built purely to extract money. The scammer invests weeks or months of conversation before invoking a medical emergency, a customs problem or an investment opportunity. The photos used are almost always stolen from an uninvolved third party.
- Pig butcheringShā zhū pán
- An industrialised hybrid of romance and investment fraud: the victim is “fattened up” through a trusting relationship, then steered onto a fake crypto trading platform. These operations are often run from organised scam compounds in South-East Asia.
- Fake trading siteFake investment platform
- A site imitating a legitimate broker, showing a dashboard and fictitious gains entirely controlled by the scammer. Deposited funds are never invested. Blocked withdrawals paired with demands for “taxes” or “release fees” are the most reliable signal.
- PhishingHameçonnage
- A message impersonating a bank, a public authority or a known service to obtain credentials, a confirmation code or a payment. No legitimate institution ever asks for a full password, a one-time code or a recovery phrase.
- ImpersonationSpoofing · fake advisor
- Passing oneself off as a bank, an authority or a known person, often by falsifying the calling number or sender address. A displayed number therefore never proves who is really on the line.
- CEO fraudBEC · Business Email Compromise
- Fraud targeting companies: an email impersonating an executive or a supplier orders an urgent, confidential transfer, often to a new IBAN. Verification through an independent, previously known channel remains the most effective defence.
- SextortionWebcam blackmail
- Blackmail based on intimate images, real or merely claimed, with a threat to send them to contacts. Paying almost never stops the demand. Screenshots, account identifiers and payment traces should be preserved for the report.
- Recovery scamSecond-round fraud
- A second scam targeting people who have already been defrauded. A “recovery agent” guarantees reimbursement and demands fees payable up front, often in cryptocurrency. A guaranteed outcome or a mandatory advance payment are consistent warning signs.
Digital traces and crypto
- OSINTOpen-source intelligence
- Collection and cross-referencing of information that is legally available to the public: profiles, listings, registries, domains, images and blockchain data. OSINT documents verifiable elements; it never authorises access to a private account or system.
- TXIDTransaction hash
- The unique identifier of a transaction recorded on a blockchain. Anyone can use it to retrieve the amount, timestamp and the sending and receiving addresses on a public explorer. It is the single most useful item in a crypto fraud file.
- Wallet addressPublic address
- A string identifying a destination on a blockchain. Public by design, it can be viewed and followed by anyone. It must never be confused with the private key or recovery phrase, which are shared with no one — ever.
- Blockchain tracingOn-chain flow analysis
- Following an address's public transactions onward until an identifiable exit point such as a regulated platform. Tracing establishes a path; it does not return funds and does not by itself reveal a civil identity.
- MixerTumbler
- A service that blends funds from many origins to break the readability of flows. Its use complicates tracing without always making it impossible, and is in itself an indicator of intent to conceal.
- Money muleFinancial mule
- Someone whose bank account or wallet is used to receive and then forward fraudulent funds. Some are complicit, others are recruited under cover of a fake job — and still carry legal exposure.
- WHOISDomain registration record
- A public record giving a domain's creation date, registrar and sometimes its contact. A domain created days or weeks before an investment approach is a common warning sign.
- Certificate TransparencyTLS certificate logs
- Public logs listing the TLS certificates issued for a domain. They make it possible to date a site's appearance and to discover sibling sites or subdomains reused by the same actor.
Swiss framework and procedures
- Article 146 SCCFraud — Swiss Criminal Code
- The provision criminalising fraud under Swiss law: deception by cunning, the victim's resulting error, and an act damaging their assets. It is the usual legal basis for a criminal complaint after an online scam.
- FINMASwiss Financial Market Supervisory Authority
- The Swiss supervisory authority for banks, insurers and financial service providers. It publishes a warning list of unauthorised actors. It does not recover funds on behalf of private individuals.
- OFCSFederal Office for Cybersecurity · former NCSC
- The federal point of contact for reporting an incident or online scam in Switzerland. A report feeds national threat awareness; it does not replace a criminal complaint filed with the cantonal police.
- Criminal complaintFiling a complaint
- The act by which a victim brings a case to the prosecuting authorities, through the cantonal police or Suisse ePolice. Some offences are prosecuted only on complaint within a three-month window, so acting early matters.
- Fund recallRecall · chargeback
- A request to the sending bank to attempt to reverse a transfer or card payment. Success depends above all on speed: the first 24 to 72 hours are the window in which a freeze remains realistic.
- Evidence preservationChain of custody
- Keeping material in its original state — timestamped screenshots, messages, statements, URLs and identifiers — without editing or deletion. A documented file always separates established facts from hypotheses and their limits.
Frequently asked questions
What is OSINT in one sentence?
OSINT is the collection and cross-referencing of information that is legally available to the public — profiles, registries, domains, blockchain data — in order to document verifiable facts, without ever accessing a private account or system.
What is the difference between tracing funds and recovering them?
Tracing follows public transactions to an identifiable exit point; it establishes a path. Recovery requires an authority, a bank or a regulated platform to decide to freeze and then return assets: these are two distinct stages, and the second is never guaranteed.
Is a TXID enough to identify a scammer?
No. A TXID identifies a transaction and its addresses, not a person. It becomes useful when it leads to a regulated service subject to identification duties, where only an authority can act.
Why be wary of a company that guarantees recovery?
Because no provider controls the decision of a bank, a platform or a judge. A guaranteed refund combined with fees payable in advance matches the classic recovery-scam pattern, which targets people who have already been defrauded.
Still unsure what a term in your case means?
We review the material you have and tell you, without promises, what an investigation can and cannot establish.
Request a feasibility reviewRead next
Official sources
These definitions are informational and do not constitute individual legal advice. For any decision, consult a professional qualified for your situation.