Fake Commercial Register Emails: How Scammers Target Swiss Company Directors

"Grüezi, sehr geehrte Geschäftsleitung" ("Hello, dear management"). That is how an email currently doing the rounds in Swiss businesses opens. It claims to be from the Eidgenössisches Amt für das Handelsregister, the Federal Commercial Registry Office (FCRO), known by its German acronym EHRA. The tone is deliberately dull and bureaucratic: after recent changes to your entry, the email says, it appears some of your company data may be wrong. Please correct it. It is a fake, and a noticeably more polished piece of commercial register phishing than the usual junk.

Cybercrimepolice.ch, the prevention platform run by the Zurich cantonal police, flagged the campaign on 4 November. Two days later BACS published its own warning, saying it was "currently receiving numerous reports" about the supposed data update. The commercial registry office of the canton of Aargau has also put a warning on its website. We went through the official notices to explain how to spot the fake, why company directors are the target, and what to do if someone has already clicked.

How the scam works

The email: deadline, threat, official tone

According to Cybercrimepolice.ch, recipients are given six working days to act. Ignore it, the message warns, and you face administrative measures, temporary deletion of your entry and "difficulties with business transactions". It is the textbook formula: an authority, a short deadline and a consequence that sounds existential for a business. If you are worried that your bank or customers might suddenly be unable to find your company in the register, you are less likely to look closely at the sender.

The website: a staged government procedure

The link opens a page that mimics the federal government's web design. It first asks for a reference number, then for details about the person, the company and how to reach them. Next, it claims to verify your "authorisation" using your IBAN and asks for the name of your bank. Progress bars and a final success message make the whole thing feel like a proper administrative process.

What the page does not ask for is telling. The official descriptions do not mention passwords or card numbers. That does not make it harmless. Cybercrimepolice.ch considers it plausible that the criminals will use the data for targeted follow-up attacks, such as spear phishing or phone scams (vishing) in which they pose as the registry office again or as staff from the bank you named. The warning does not cite any confirmed follow-up cases so far.

Why company directors are in the firing line

The Swiss commercial register is public by design. Through Zefix, the federal central business name index, and the cantonal register extracts, anyone can look up a company's name, registered office and authorised signatories. For fraudsters that is a ready-made mailing list. They know whom to write to and can dress up the email with accurate company details. BACS warns about exactly this: stay alert even when the company name, address or register number look right at first glance.

Addressing the email to "management" is deliberate. Cybercrimepolice.ch believes the aim is to reach people with decision-making or administrative responsibility. In many small businesses, the owner or managing director deals with official mail in between client meetings and payroll. Anything that sounds like a legal obligation tends to get handled quickly. And the people reading these emails are often the same people who can authorise payments. Anyone who knows which bank a company uses, and who signs for it, has done half the groundwork for a later call "from your bank".

The basic pattern is not new. The Aargau registry office is also warning about fake commercial register invoices and reminds newly registered firms that private "registers" try to sell them overpriced listings. We looked at how AI is making this kind of social engineering harder to spot in our piece on AI-driven phishing and Swiss SMEs.

How to tell genuine registry mail from a fake

The key rule is simple: never verify through the channel the message offers you. Links, phone numbers and reply addresses in a suspicious email may lead straight back to the criminals. Go to your cantonal commercial registry office's website yourself and use the contact details published there. You can check your own entry at any time on zefix.ch, with no login and no reference number.

The Aargau registry office states explicitly that it does not send requests demanding an immediate data update via a link and threatening deletion if you fail to comply. It also points to how the register actually works: entries are based on a filing and must be backed by supporting documents, such as notarised deeds or minutes. A "data check" through a web form that asks for your IBAN simply does not fit that process.

For invoices, the canton of Aargau lists its own identifiers: a fixed IBAN, a reference number with a fixed prefix, and always a named contact person with a phone number and an @ag.ch email address. Other cantons use different details, so it is worth looking up your own canton's once and filing them with your accounts team.

Checklist for SMEs

• Don't click, don't type. Do not open links in these emails or enter any company, personal or bank details.
• Verify independently. Contact your cantonal registry office via its official website, found by yourself, and check your entry on zefix.ch.
• Read the sender carefully. BACS advises watching for small deviations in addresses, for example info@company-switzerland.com instead of info@company.ch, and for unusual wording.
• Forward, then delete. Send suspicious emails to Cybercrimepolice.ch or report them through the BACS reporting form.
• Brief your team. Make sure accounts, the front office and anyone who opens official mail know about the scam.
• Agree a call-back rule. Anyone calling "from the bank" or "from the authorities" and asking for data or payments gets called back on the known, official number.
• Maintain an online presence. BACS recommends that companies without a website run at least a simple official one and search for their own company name regularly to catch misuse early.

Already clicked or entered data?

If you only opened the link without entering anything, you have not handed over any data based on what is known so far. The authorities describe a data-harvesting form, not a malware download. If the form was filled in, here is what to do:

1. Tell your bank. Because the IBAN and bank name were requested, your bank should know these details may be in the wrong hands. It can monitor accounts more closely and alert you if someone contacts it in your name.
2. Keep the evidence. Save the email including its headers, screenshots of the fake site and a note of what was entered, as Cybercrimepolice.ch recommends.
3. Treat follow-up contact with suspicion. Expect calls or emails that build on the stolen details, supposedly from your bank or the registry office. Watch for unusual orders, invoices or contracts in your name.
4. Report it to the police. If there is actual misuse or financial loss, contact your cantonal police. If money has already been transferred, call your bank immediately: the faster you act, the better the chance a payment can still be stopped.
5. Notify BACS. Even without any loss, a report helps complete the national picture and warn others.

If credentials or devices turn out to be affected after all, a structured response pays off. Our playbook for the first 24 hours was written for ransomware, but its principles on communication, evidence and reporting apply here too.

Our assessment

This is not mass spam you can laugh off. It hits a sore spot: official correspondence that businesses have to take seriously, combined with public company data that lends the fake credibility. The fact that the site collects bank and contact details rather than passwords suggests to us that a second phase is planned. The more dangerous message is probably not this email, but the phone call that comes weeks later and convinces you with surprisingly accurate details.

The good news is that defending against it costs nothing. A firm call-back rule, a quick heads-up to staff and the principle of contacting authorities only through details you looked up yourself will defuse this campaign and many future variants. For the bigger picture on Swiss cyber resilience, see our analysis of the latest BACS semi-annual report.

Sources

• BACS: Phishing emails sent in the name of the commercial register (FCRO), 6 November 2026
• Cybercrimepolice.ch (Zurich cantonal police): Gefälschte EHRA-Mail fordert zur Aktualisierung von Handelsregisterdaten auf (German), 4 November 2026
• Canton of Aargau, Commercial Registry Office: Handelsregister - warning about fake emails and invoices (German), 5 November 2026
• Mimikama: Gefälschte Handelsregister-Mail droht mit Löschung (German)
• BACS: Cyber incident reporting form
• Zefix: Central Business Name Index