Fake Migros CHF 765 Invoice Scam: The Support Phone Number Is the Real Trap

A receipt carrying the Migros name thanks you for a purchase worth CHF 765. You don’t recognize the order, but a support number is waiting below.

Calling to challenge it feels like the sensible next move. Before doing that, check who supplied both the worrying receipt and the proposed help.

Overview

The invoice invents the problem that makes you call

The fake Migros invoice scam uses a fabricated purchase to send readers toward an impostor’s telephone support line.

The Swiss National Cyber Security Centre’s callback warning includes the original CHF 765 example. It describes repeated reports involving false invoices and transaction alerts.

Migros is the legitimate retailer being impersonated. The email is not evidence that the store charged you or sold the listed items to someone using your account.

The support conversation is where the risk can grow

The published receipt lists expensive goods and presents a contact for assistance. Its callback digits remain partly masked in the original image.

The agency describes callers being pressed for sensitive data, codes, payment approvals, or, in some cases, remote access to their computers.

A telephone number can therefore be the dangerous instruction even when you avoid links and attachments. Calling it puts you inside the sender’s own process.

Check the payment through records the email doesn’t control

Your real financial account and the retailer’s independently reached support are better places to investigate an unfamiliar purchase.

• Don’t call the help number printed in the suspicious receipt.
• Check your actual bank or card records for a corresponding transaction.
• Contact Migros through its genuine website if an order question remains.
• Don’t provide banking secrets to cancel an order you never verified.
• Report codes, approvals, or remote access promptly if you already called.

Why a Receipt Can Be More Persuasive Than an Advertisement

A sale asks whether you want something. A receipt tells you something already happened, which can make the decision feel much more urgent.

Your first thought may be that a card was stolen or an account was misused. You want an explanation before another charge appears.

The support number offers an immediate action. It seems to turn an alarming message into a problem with a convenient solution.

That convenience is the part to question. The person presenting the problem has also chosen the contact that supposedly fixes it.

Item names and a precise total help the purchase feel real. Yet a detailed list can still be invented without any transaction in your account.

Keep the distinction between a claim and a record. The email claims a payment; your financial institution records whether a payment actually exists.

You don’t have to dismiss the possibility of fraud to refuse this number. You can investigate a real unauthorized charge through your actual bank.

How the Fake Migros Invoice Scam Works

Step 1: A branded order record creates alarm

The message presents a completed purchase rather than asking permission to make one. That encourages you to react to the apparent financial event immediately.

The illustrated receipt includes a costly bottle of white wine. The NCSC flags that detail as inconsistent with Migros’s offering.

It’s a useful clue in this example, not the only check you should apply. Another false receipt could use a more plausible list.

Don’t wait for an obvious product mistake before verifying an unexpected charge. A convincing item list still needs to match genuine records.

Step 2: The supplied number appears to be the cancellation route

The instruction makes calling seem safer than clicking. You may believe you’re avoiding an online trap by speaking to someone instead.

But the number’s placement on an untrusted receipt doesn’t authenticate it. A professional greeting after you dial doesn’t solve that problem.

Nor does a familiar-looking area code. The agency notes Swiss numbers in this campaign, but no prefix should be treated as either proof or a blanket blacklist.

Find the real organization’s contact separately. Don’t use another contact copied from the same message to confirm the first one.

Step 3: The false helper turns cancellation into a request for secrets

Once you call, someone can explain why supposedly simple cancellation requires more information. The conversation helps them respond to your doubts in real time.

The claimed purchase becomes a reason to discuss banking details or an authentication request. You may think you’re protecting money while providing a new route to it.

Keep the proposed action literal. Sharing an access code or approving a payment is not just giving customer service permission to investigate.

If the helper becomes impatient when you pause, end the call. You don’t need to satisfy someone whose identity remains unverified.

A refusal to share secrets doesn’t leave you unable to dispute a real charge. Your own financial provider can explain that process independently.

Step 4: Some calls escalate into remote access or payment approvals

Remote-maintenance software may be introduced as a way to cancel or reverse the supposed purchase. That can expose the computer as well as the account.

Legitimate software doesn’t make an unverified operator legitimate. The important permission is what that person can see or control once connected.

If they ask you to open online banking while connected, stop. Don’t let the need to resolve the receipt turn into permission to watch your financial session.

Likewise, don’t approve a TWINT request described as a reversal without understanding the actual operation. The caller’s explanation cannot change what you authorize.

A Phone Call Isn’t an Independent Check When the Email Chose the Number

Calling the receipt’s number lets its sender answer your questions. Find the real retailer’s contact elsewhere before deciding who you are speaking to.

You could hear hold music, a familiar company name, or a detailed explanation of the order. Those are still things the person answering can provide.

A case reference works the same way. A number printed in the receipt can be repeated by the caller without proving any connection to the real retailer.

Instead, use the retailer’s genuine website or a contact you’ve already established. If the matter involves an actual bank charge, use the bank’s own route.

Keep the original suspicious message available to describe the claim. Don’t let its wording become the only version of events you give genuine support.

For example, distinguish between receiving a receipt and finding a debit in your account. Those observations deserve different responses.

You can say you received a false-looking order email while separately asking whether an unfamiliar transaction exists. Accuracy makes the investigation easier.

What If Your Bank Shows No Matching Payment?

A missing charge weakens the email’s story, but it isn’t a reason to call the disputed number for an explanation.

Check the appropriate card or account through its genuine app. If you’re uncertain about a pending operation, ask the financial provider to interpret it.

Don’t send money to test whether the account is secure. Don’t perform a cancellation payment because the person on the phone says no debit appears yet.

If you share household finances, ask the other authorized payer about the actual records. Avoid turning a family check into an argument based only on an email.

If no one called or disclosed information, reporting the message may be the main next step. Receiving the receipt doesn’t establish that anyone accessed your accounts.

If someone already called, assess that conversation separately. The original purchase may be imaginary while the later code disclosure is real.

This is the distinction that matters most after a callback: don’t let the absence of the advertised charge hide a new exposure created during the call.

In a shared work inbox, check whether a colleague already responded before treating the receipt as an untouched message. One person may have called while another checked accounts.

Agree who will contact the real retailer and who will speak to the financial provider. That avoids conflicting instructions while urgent protection is underway.

Warn colleagues about the receipt’s cancellation story without forwarding a clickable invitation to call. Keep the complete original privately for whoever handles the report.

For a shared card, involve its authorized holder. They may need to speak to the issuer directly, even when someone else received the false order.

Ask what happened without blame. A clear account of a call or installation is more useful than arguing about why the person trusted the receipt.

The Real Retailer’s Warning Supports a Different Route

Migros’s own phishing guidance warns about false invoices, receipts, and supposed customer-service calls using its identity.

It gives you a reason to verify the message without accusing the genuine store of organizing the fraud.

Use genuine support for a retailer question and your bank for financial exposure. One report does not automatically perform the other organization’s protective actions.

When you report, include the original receipt and any callback details already available. Preserve the number as evidence rather than inviting others to dial it.

If the number is later disconnected, that doesn’t settle what happened during a previous call. Continue protecting information and investigating actual transactions.

Equally, a number that still answers doesn’t prove the operation is legitimate. Availability is not authentication.

What to Do if You Have Fallen Victim to This Scam

1. End contact with the supplied support line. Don’t continue a cancellation session, accept another callback, or follow a link introduced by the person answering.

   Keep the receipt and record when you called. If you only read the email, report it without dialing to see who responds.

2. Tell your bank about any financial disclosure. Use a contact from the real banking app, your card, or the institution’s genuine website.

   Describe the false receipt and what the caller asked you to do. Include card data, login information, codes, approvals, and any actual transfers.

   Ask how to protect affected access and payment methods. Don’t reduce the report to the invented CHF 765 purchase if another operation actually occurred.

3. Act on remote access if you allowed it. Disconnect the suspicious session and avoid signing into financial services while the stranger can observe or control the device.

   Seek help removing the remote-access software and checking for unwanted changes. Use a trusted device or verified support route for sensitive recovery.

   Change exposed credentials and review relevant sessions with the providers involved. Simply deleting the receipt doesn’t undo access granted during the call.

4. Review unwanted transactions with the appropriate provider. Preserve the actual amount, currency, recipient, date, and reference for each disputed operation.

   Ask about the available recovery process and deadlines. Don’t approve another outgoing action on the promise that it will cancel the first.

   If TWINT was involved, contact support for your actual app. A retailer’s phishing report is not the same as securing a payment account.

5. Save the evidence privately. Retain the original message, existing screenshots, displayed numbers, call times, and any account alerts.

   Write down the sequence in ordinary terms. Note which requests you followed, which you refused, and what you cannot remember.

   Don’t publish complete financial identifiers or passwords while asking for help. Don’t call again or reinstall software to reconstruct the incident.

6. Report the impersonation through genuine channels. Notify Migros independently and use your email provider’s phishing-report function.

   Report financial loss to the relevant authorities, including local police where appropriate. Keep any case numbers for later discussions with the financial institution.

7. Use security tools for the exposure they can address. If software or a suspicious file was involved, Malwarebytes can help examine the device.

   AdGuard can filter some malicious web content. Neither product establishes who answered the phone, reverses a payment, or secures a disclosed bank code.

   A call alone isn’t proof of malware. Describe installations and permissions specifically so cleanup doesn’t distract from urgent account protection.

8. Be wary of a second rescue offer. Don’t pay an unexpected caller to close the case or recover the disputed money.

   Continue through contacts you established independently. Someone repeating the receipt amount or case reference hasn’t proved they represent the bank or retailer.

Frequently Asked Questions

Does the CHF 765 receipt prove my card was charged?

No. It’s the claim made by the fraudulent message. Check the actual financial record through your bank or card issuer.

Is calling safer than opening a link?

Not when the untrusted message chose the number. Contact the real organization independently rather than switching into the sender’s telephone process.

Does a Swiss telephone number make the helpline genuine?

No. The number’s appearance doesn’t authenticate its operator. Do not label every number sharing an area code fraudulent either.

Why is the white-wine entry relevant?

The NCSC highlights it as inconsistent with the Migros example. Other false receipts may look more plausible, so use independent payment and contact checks.

What if the caller only asked me to install a familiar application?

A legitimate remote-access application can still give an impostor control. Report the installation and permissions, end access, and protect accounts used during the session.

Is deleting the receipt enough after a call?

No. Assess what you shared or authorized on the phone. Secure exposed accounts and report actual financial activity before discarding the message.

The Bottom Line

Don’t call the support number on the fake Migros invoice. The fabricated purchase is meant to make you seek help from the people behind it.

If you already shared banking information, approved a payment, or allowed remote access, contact the relevant providers promptly. Investigate the real records, not the caller’s cancellation story.