Online fraud: the questions we are asked most
Twenty-four real questions, asked by people who have just been defrauded online in Switzerland, with short, verifiable answers and no promise of a result.
First actions
What should I do in the first 24 hours after an online scam?
Stop any further payment immediately, contact your bank to have payment methods blocked and transfers recalled, then preserve every exchange without deleting anything. These three actions determine what can still be blocked and what can be proven afterwards. Filing a complaint can follow in the coming days, but a recall request is decided in hours.
Do I have to file a complaint before hiring a private investigator?
It is not mandatory, and the two can proceed in parallel. Filing a complaint officially records the facts and opens the way to the formal requests that only the authorities can address to banks and platforms. A private investigation documents in advance what is publicly visible, which makes the complaint more precise and easier to process.
Is my case too small to be worth handling?
No amount is too small to report to the authorities: small sums almost always belong to campaigns affecting hundreds of people, and your report may complete an existing case. A private investigation does have a cost, however, and we say so plainly when the report would cost more than the sum at stake. That is exactly what the feasibility review establishes before any engagement.
How long after the events is it still worth acting?
The chances of a banking block fall away within hours, but the value of documentation does not disappear. Months later, an investigation can still link your case to a known network, find reused infrastructure and follow flows on public ledgers, which do not get erased. Acting late is better than not acting, even if the range of possible actions narrows.
What an investigation can do
Can a private investigation identify the person behind a scam?
Sometimes, and never with certainty announced in advance. The work consists of cross-referencing public traces — profiles, reused photographs, domain names, infrastructure, visible financial flows — until a body of consistent evidence emerges. Depending on the case, that leads to a person, to a structure, or only to an organisation with no identifiable name. No serious provider guarantees an identification.
What does an investigation report actually contain?
A report sets out a dated chronology of the facts, the technical elements observed with their sources, an analysis of the visible financial flows, and an explicit separation between what is established, what remains a hypothesis and what could not be verified. It ends with the limits of the analysis and the actions that can be considered. It is a document meant to be read by your lawyer, your bank and the authorities.
Can you recover my money directly?
No. No private actor can seize funds, compel a foreign bank or empty a crypto wallet: those powers belong to the judicial authorities. Our work is to document the trail so that recovery steps taken by your lawyer, your bank or the criminal proceedings rest on solid material. Any promise of guaranteed restitution should be treated as a warning sign.
Do you work with the police?
We are independent of the police, of FINMA and of any authority. The report we produce is given to the client, who is free to pass it to their lawyer or attach it to their complaint. We do not substitute for criminal proceedings or for a law firm, and we claim no official status.
The Swiss legal framework
Is an OSINT investigation legal in Switzerland?
Yes, as long as it stays within publicly accessible information: search engines, social networks, public registers, domain name data, public blockchains. The limit is unauthorised access to a system or an account, prohibited by art. 143, 143bis and 144bis of the Swiss Criminal Code. A serious investigation observes what is public and does not cross that line.
Can you access an account or a phone?
No, and nobody should be offering to. Unauthorised access to an email account, a phone or a computer system is a criminal offence in Switzerland. Beyond the risk involved, evidence obtained unlawfully cannot be used in proceedings: it weakens the case instead of strengthening it.
Is the report admissible in court?
A private report does not carry the weight of an official investigative act, and the assessment of evidence is for the judge. Its practical value lies in its method: cited sources, timestamps, a clear distinction between facts and hypotheses, elements a third party can verify. It serves to guide and support a complaint or a civil claim, not to replace one.
Which offences cover online fraud in Switzerland?
Fraud is covered by art. 146 of the Swiss Criminal Code, computer fraud by art. 147, extortion and blackmail by art. 156 and coercion by art. 181. Depending on the facts, unauthorised access to a computer system, identity misuse or money laundering may also apply. The exact classification is for the prosecuting authorities.
Evidence and data
What evidence should I preserve, and how?
Keep whole conversations rather than extracts, full URLs rather than partial screenshots, transfer receipts with their reference, crypto transaction identifiers and wallet addresses. Add a date to every item and save everything outside the device concerned. A dated, complete file is worth more than the memory of an exchange.
Am I allowed to keep screenshots of private conversations?
Keeping the exchanges you took part in yourself, in order to assert your rights, is the ordinary situation of a victim building a case. Caution is warranted, however, about publishing such content, which can engage your own liability. If you are unsure what you may publish or pass on, ask a lawyer before doing it.
What happens to my documentation after the investigation?
The material you provide is used solely to handle your case and is not passed to third parties without your agreement, save where the law requires it. The processing and retention terms are set out in our privacy policy. You remain the owner of your exhibits and of the report you receive.
Can I still act if I deleted the exchanges?
Yes, though the case starts at a disadvantage. Much of the material exists somewhere other than your device: bank statements, platform histories, email headers still held by your provider, transactions recorded on a public blockchain. Ask the platform and your bank quickly to preserve the data, before their internal retention periods expire.
Money and financial flows
Can a bank transfer be recalled?
A recall request is possible as long as the funds have not been withdrawn from the receiving account, and it must be made by your bank to the beneficiary bank. Success depends on speed, on the destination country and on the cooperation of the receiving institution; it is never guaranteed. Make the request in writing and note the exact time.
Can cryptocurrency be traced after a scam?
On public blockchains, transactions are permanently visible and the path of funds can be reconstructed address by address. This tracing shows where funds travelled, and sometimes that they reached a regulated service that can respond to a formal request. It does not by itself reveal the identity of the holder, and it allows no direct recovery.
What if the money has gone abroad?
That complicates the process but does not close it. Filing a complaint in Switzerland remains the first step: international mutual legal assistance exists precisely for these situations, and precise documentation of the route makes the request easier. The more the final beneficiary is a regulated service, the better the chances that an official request succeeds.
Can legal expenses insurance help?
Often yes, depending on the terms of your policy, in particular for covering lawyer's fees in a dispute or criminal proceedings. Report the claim quickly, as policies include notification deadlines. A chronological, documented file markedly speeds up the insurer's review of your claim.
Avoiding a second scam
What is a recovery scam?
It is a fraud that specifically targets people who have already been defrauded: a supposed specialist, lawyer or "recovery agency" contacts you, claims to be able to get your funds back and asks for an upfront payment. Victim lists circulate among fraudsters, which is why these approaches seem to arrive at just the right moment. The most useful rule is simple: never follow up on an unsolicited approach promising recovery.
How do I check that a provider is legitimate?
Look for a real address, a named editorial identity, written terms and an honest description of the limits of the service. A serious provider states what it cannot do, guarantees neither identification nor recovery, and does not contact you out of the blue after a scam. Be wary of promised outcomes, payment in cryptocurrency and manufactured urgency.
Should I pay a "fee" to release blocked funds?
No. No legitimate authority, bank or platform demands a tax, a deposit or customs charges to be paid urgently in order to release blocked funds. This scenario is the most consistent marker of secondary fraud. Every such payment calls for another and never results in restitution.
Why am I being contacted again after a first scam?
Because you are now on a list: victims' details are resold or reused by the same networks, which know that someone who has already paid is more likely to pay again. A spontaneous contact that refers precisely to your case is not proof of legitimacy, but often the opposite. Report these approaches and do not reply.
Your situation is not on this list?
Describe the facts: we will tell you plainly what is workable, what is not, and what an investigation could establish. Confidential feasibility review before any engagement.
Open my investigation file
Official sources
These answers are informational and do not constitute individual legal advice. For any decision, consult a qualified professional with regard to your situation.