Salt Invoice Scam: An Unpaid Bill Turns Into a Fake Double-Charge Refund

A Salt email says your latest payment failed. Settle the bill, it warns, or your service could be interrupted.

You follow the account instructions, only to see a different problem appear: apparently you’ve paid twice, and a refund is waiting.

Overview

The unpaid bill is the opening claim, not a verified balance

The Salt invoice scam impersonates the Swiss telecom provider with an email about a failed payment. It directs recipients to a fraudulent account page.

The page copies Salt’s login design and collects account credentials. It then changes the story from money owed to money supposedly due back.

Zurich cantonal police documented this billing-to-refund sequence on September 30. The email above is an original example published with identifying fields obscured.

Salt is the company being impersonated. The warning doesn’t accuse the provider of inventing customer bills or operating the cloned website.

A supposed duplicate debit creates a second request for information

After the imitation login, the site claims a double charge and offers reimbursement. It asks for personal information and then payment-card details.

Entering those details puts the card at risk of unauthorized use. The refund story doesn’t make the collection harmless.

• An apparent unpaid bill threatens disruption to a useful everyday service.
• The email’s payment button leads to a Salt lookalike rather than the genuine account.
• The imitation login captures customer credentials.
• A false duplicate-charge claim makes supplying more information seem helpful.
• The final card request creates a financial exposure beyond the stolen login.

Verify the bill and the refund through independent records

Open your actual Salt account through your established route. Check the real balance, payment history, and any genuine reimbursement directly with the provider.

Also check your bank or card records. A statement on the suspicious website is not proof that two debits occurred.

If credentials and a card were entered, both need attention. Securing only the provider login leaves the payment information exposed.

Why the Change From Debt to Refund Can Keep You Engaged

The first message gives you a problem to solve: keep your phone or other service working. You arrive prepared to sort out account administration.

Then the page offers relief. Instead of owing money, you apparently deserve some back. Continuing can feel like fixing the original problem.

That change should prompt a check, not another form submission. The site supplied both the accusation of nonpayment and the supposed evidence of overpayment.

Nothing independent has confirmed either claim. A reassuring refund screen doesn’t become more trustworthy because the previous screen worried you.

It also changes how people think about the card request. When you expect money to arrive, you’re less likely to notice a payment method being exposed.

The useful distinction is simple: information entered on a fraudulent page goes to that page’s operators, regardless of whether the button says pay or refund.

This doesn’t mean every real reimbursement request is fraudulent. It means an unverified email can’t appoint its own website to resolve a claimed billing error.

Step outside that sequence and check the actual account. You can investigate a possible bill without accepting the sender’s version of your payment history.

How the Salt Invoice Scam Works

Step 1: A failed-payment notice threatens service interruption

The email says an amount remains unpaid for the latest billing period. It asks the recipient to settle promptly to avoid interrupted service.

The original French example uses a “Régler ma facture” button, meaning settle my bill. Salt appears as the sender, but the address isn’t the provider’s.

Branding can make a familiar recurring expense feel urgent. The message doesn’t need a dramatic threat if losing service would disrupt your day.

Before paying, check the real bill. If there is an actual overdue amount, resolve it through the provider’s genuine process rather than this email.

The published email also says recipients who already paid can ignore it while the account updates. That ordinary-sounding qualification can make the reminder feel less aggressive.

It still doesn’t authenticate the payment button. Criminals can include a reasonable explanation for a recent payment while directing everyone else to an imitation login.

If you know you paid, use your own receipt or statement to check it. Don’t enter the site merely to see which explanation it gives.

Step 2: The button leads to a copied account login

The destination resembles Salt’s customer sign-in page. It asks for credentials before presenting the next stage of the claimed billing task.

Entering them discloses account information to the criminals. The page’s familiar appearance doesn’t connect it to your real customer account.

If you typed a password and then stopped, the exposure still needs attention. You don’t have to reach the card page before acting.

Don’t retry with another password if the form seems not to work. Use the real provider’s recovery process to check your access.

Step 3: The page claims the bill was charged twice

After the imitation login, the story pivots. The site says a double debit occurred and a refund should be arranged.

The site now wants you to believe two charges occurred. Your bank hasn’t confirmed that simply because the next screen says so.

Check actual transactions before accepting the premise. If the alleged debits don’t appear in genuine records, don’t supply details to “correct” them.

Even if you have a real billing question, contact Salt independently. An unrelated genuine problem wouldn’t authenticate this particular refund page.

Step 4: A refund form collects personal and card details

The process asks for personal information and then payment-card details. These submissions give the operators more than access to a telecom account.

A card can be exposed even if no charge appears immediately. Don’t wait for the promised refund or a visible loss before contacting its issuer.

The police advisory warns of unauthorized payments and further fraud. It doesn’t establish a fixed subscription, fee, or identical outcome for every recipient.

Report what you actually entered rather than guessing what the site might do. A password, card number, and identity document require different responses.

Step 5: The account and payment exposures need separate containment

A password reset can protect the customer login going forward. It doesn’t withdraw card details already sent to another website.

Conversely, blocking the card doesn’t replace an exposed Salt password or secure another account where that same password was reused.

Make both reports where applicable: provider support for the login and bank or card issuer for the payment method.

Keep a record of each conversation. One organization’s case number shouldn’t be mistaken for confirmation that the other has already acted.

Check the Two Billing Claims Separately

Was a real Salt bill unpaid?

Use your known account route or a previously established provider contact. Find the billing period, amount, and actual payment status.

A real bill may exist even while a fake message is circulating. Don’t ignore genuine account obligations merely because this impersonation campaign exists.

If payment was recently made, ask the provider about its record rather than sending another amount through the questionable page.

Did your bank actually show a duplicate payment?

Inspect the genuine bank or card statement independently. Compare completed transactions with pending entries, and ask your provider to clarify anything you don’t understand.

Don’t accept a screenshot or account summary supplied by the refund page as a substitute. The operators can display whatever supports the next request.

If you identify a real duplicate, resolve that specific transaction through the bank and provider. You still don’t need the unverified email’s website.

Keep the two supposed charges separate in your notes. Record whether each appears in the real statement or only on the suspicious page.

That avoids reporting an invented duplicate as an actual bank debit. It also helps the issuer identify any genuinely unauthorized transaction among normal account activity.

Who is asking for the card information?

The promise of reimbursement doesn’t identify the recipient of your data. Confirm the organization and process before disclosing any payment information.

Salt’s official cost-control and fraud guidance also advises against giving sensitive financial details in response to incoming calls.

Apply the same independent check if someone phones afterward about the alleged error. Knowledge of a billing concern doesn’t prove who controls the call.

Keep the Genuine Account Usable While You Respond

Reach Salt through the real app, account, or established support route. Tell staff that a phishing page received your credentials.

If you still have access, review available contact and account information for changes. If not, request recovery through the legitimate provider.

For a family plan or company-managed subscription, involve the actual account holder. A second person may need to help verify details or prevent duplicate actions.

Don’t approve a security code merely because someone says it is needed to repair the account. Confirm the action with the genuine service first.

Use a new password that isn’t shared with other logins. Changing one character in a reused password leaves your accounts needlessly connected.

Document changes you didn’t make before correcting them with support. Those details can help explain what happened after the credentials were exposed.

What to Do if You Have Fallen Victim to This Scam

1. Stop the supposed refund. Leave the website and don’t provide extra information to make the reimbursement “finish.”

   Save the email, subject, received time, and destination already in your records. Avoid another visit to gather information the real providers haven’t requested.

2. Contact the card issuer if you entered a card. Explain that its details were supplied to a fake Salt refund page.

   Ask about blocking or replacing the card and reviewing transactions. A missing immediate charge doesn’t establish that the details remain safe.

3. Reset the exposed Salt login. Start through the genuine service, not the phishing email or a new reset message sent by its operators.

   If that password was used elsewhere, replace it on those accounts too. Give priority to email and financial services using the same credentials.

4. Have Salt check the real billing position. Confirm actual unpaid amounts or duplicate payments independently so the fraud doesn’t leave a genuine issue unresolved.

   Ask support about unauthorized account changes. Don’t pay a stranger to keep the service active while the provider reviews your report.

5. Report any completed payment accurately. Tell the bank the amount, merchant or beneficiary, time, and any approval you made.

   Ask about the available dispute or recovery process. Don’t promise yourself a refund based on the fake page’s status message.

6. Check additional exposure without assuming infection. If you downloaded or opened unexpected software, seek trusted help and consider checking the device with Malwarebytes.

   AdGuard may reduce access to known scam pages. These tools don’t block a card on your behalf or erase a password already collected.

7. Keep evidence for police and follow-up. Retain messages and actual transaction records privately, including any later calls connected to the false bill.

   Use the police portal’s reporting information for tips, and contact competent local police when making a formal complaint.

Don’t Let a Second Refund Promise Become Another Loss

A person who later offers to recover the money may know details from the first exchange. That knowledge doesn’t make them a legitimate investigator.

Be especially cautious if they ask for a recovery charge, replacement payment, or remote access before funds can be returned.

Keep working with the provider and bank you contacted independently. Don’t follow a new caller’s instruction to withdraw a report or conceal a transaction.

If several payments appear, list them individually rather than treating the first amount as the whole incident. Your issuer needs the actual entries to investigate.

Review later statements as advised by the bank. A one-time check today won’t reveal a charge that is attempted after the conversation ends.

For somebody helping you, explain the change in story: an unpaid bill became an alleged double charge. That is why both account and card checks matter.

Frequently Asked Questions

Is Salt itself responsible for this refund scam?

No. The documented campaign impersonates the provider through an unrelated email address and copied website. Keep the accusation attached to those fraudulent communications.

Did the fake page prove I paid twice?

No. Its duplicate-debit statement is part of the deception. Check your real transaction history and ask the bank or provider independently.

What if I entered the password but not a card?

Secure the exposed login and any reused credentials, then contact Salt. Tell support exactly where you stopped rather than assuming every later stage occurred.

Is blocking the card enough if I also signed in?

No. The card and customer login are separate exposures. Protect the payment method and replace the disclosed credentials through their real providers.

Should I ignore every Salt payment reminder now?

No. Check genuine billing through your established account or support route. Avoid the suspicious message without neglecting a real balance.

Does a refund-processing message mean my card wasn’t charged?

No. Text on the fake site doesn’t establish the status of your card. Check actual records and contact the issuer after disclosure.

The Bottom Line

Don’t settle a bill or claim reimbursement through the Salt invoice scam. The unpaid-bill story and duplicate-charge story come from the same fraudulent process.

If you entered credentials or a card, contact Salt and the issuer as applicable. Secure both exposures and verify real billing outside the suspicious email.