If you search for train tickets on Google and click on the first result, you may end up on a page that isn’t the SBB’s. Scammers have created fake websites that mimic the SBB’s design down to the last detail: same logo, same layout, same colours. The URL changes only slightly – just enough that you might not notice unless you look closely.
What makes this type of scam particularly dangerous is the level of detail. The fake pages display real timetables, genuine connections and even the train’s platform number. That’s enough to make you trust them. When you get to the payment stage, they ask for your card number, expiry date, CVV code or even your Twint details. And that’s when they steal from you.
Cybercrimepolice.ch has issued a specific warning about this phishing scam, which is currently circulating. The SBB say they detect and report these websites as they appear, but the problem is that the scammers are creating them faster than they can be blocked.
The simplest rule: never book train tickets via a Google link. Always type the address directly into your browser (sbb.ch or cff.ch) or use the official app. If you see a very attractive offer on a dodgy-looking website, close it and start again. The ticket isn’t worth the risk of losing all your card details.