Smishing & Phishing – Fraudsters Impersonate the Swiss Tax Authority (ESTV) During Tax Season 2026
Fraudulent SMS and email messages impersonating the Swiss Federal Tax Administration (ESTV) prompt recipients to 'review their 2025 tax assessment'. Affected are Swiss SMEs, cross-border workers, and companies in Liechtenstein with Swiss VAT obligations.
Update of October 22, 2026
We have clarified the note on how the ESTV communicates. The previous statement that the ESTV communicates exclusively by post was too absolute.
What happened?
At the start of tax season 2026, smishing and phishing campaigns impersonating the Swiss Federal Tax Administration (ESTV) are circulating. The messages ask recipients to complete a supposed "review of the 2025 tax assessment". Embedded links lead to convincingly designed phishing pages where login credentials, credit card details, or mTAN codes are harvested. Some variants contain attachments with malware.
Modern phishing kits use real-time relay infrastructure that forwards entered mTAN codes instantly, which bypasses two-factor authentication in real time. The campaign is precisely timed to match recipients' expectations: anyone anticipating a tax notification is more likely to click.
Who is affected?
- Swiss companies and their employees
- Companies in Liechtenstein (FL) with business ties or VAT obligations in Switzerland
- Cross-border workers with tax obligations in Switzerland or FL
- Trustees and accounting firms managing tax files
Particularly exposed: SMEs without a structured security awareness programme.
What should you do?
- Educate employees: Never enter login, bank or credit card details via links in text messages or emails. Genuine ESTV emails come from addresses ending in @admin.ch – but the sender can be spoofed: the ESTV itself warns of phishing emails sent as noreply@estv.admin.ch.
- Report suspicious messages: Forward to the BACS (formerly NCSC) via antiphishing.ch.
- Do not click links: When in doubt, navigate directly to estv.admin.ch and never via links in text messages or emails.
- Inform IT: Collect incoming reports internally to assess the scale of the campaign.
- Harden MFA: Secure all access to financial and tax tools with two-factor authentication and, where possible, use authenticator apps instead of SMS codes.
This advisory is for informational purposes. Contact us for support with your awareness strategy.
Ready to know your attack surface?
Tell us briefly about your project. We'll come back with a concrete proposal.
Request a first call