![\"Police-published](\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2026\/10\/salt-invoice-scam-fake-double-charge-refund-original-email.webp\" "\\"\\"")
<\/figure>\nOverview<\/h2>\nThe unpaid bill is the opening claim, not a verified balance<\/h3>\n
The Salt invoice scam impersonates the Swiss telecom provider with an email about a failed payment. It directs recipients to a fraudulent account page.<\/p>\n
The page copies Salt’s login design and collects account credentials. It then changes the story from money owed to money supposedly due back.<\/p>\n
Zurich cantonal police documented this billing-to-refund sequence<\/a> on September 30. The email above is an original example published with identifying fields obscured.<\/p>\n Salt is the company being impersonated. The warning doesn’t accuse the provider of inventing customer bills or operating the cloned website.<\/p>\n After the imitation login, the site claims a double charge and offers reimbursement. It asks for personal information and then payment-card details.<\/p>\n Entering those details puts the card at risk of unauthorized use. The refund story doesn’t make the collection harmless.<\/p>\n Open your actual Salt account through your established route. Check the real balance, payment history, and any genuine reimbursement directly with the provider.<\/p>\n Also check your bank or card records. A statement on the suspicious website is not proof that two debits occurred.<\/p>\n If credentials and a card were entered, both need attention. Securing only the provider login leaves the payment information exposed.<\/p>\n The first message gives you a problem to solve: keep your phone or other service working. You arrive prepared to sort out account administration.<\/p>\n Then the page offers relief. Instead of owing money, you apparently deserve some back. Continuing can feel like fixing the original problem.<\/p>\n That change should prompt a check, not another form submission. The site supplied both the accusation of nonpayment and the supposed evidence of overpayment.<\/p>\n Nothing independent has confirmed either claim. A reassuring refund screen doesn’t become more trustworthy because the previous screen worried you.<\/p>\n It also changes how people think about the card request. When you expect money to arrive, you’re less likely to notice a payment method being exposed.<\/p>\n The useful distinction is simple: information entered on a fraudulent page goes to that page’s operators, regardless of whether the button says pay or refund.<\/p>\n This doesn’t mean every real reimbursement request is fraudulent. It means an unverified email can’t appoint its own website to resolve a claimed billing error.<\/p>\n Step outside that sequence and check the actual account. You can investigate a possible bill without accepting the sender’s version of your payment history.<\/p>\n The email says an amount remains unpaid for the latest billing period. It asks the recipient to settle promptly to avoid interrupted service.<\/p>\n The original French example uses a \u201cR\u00e9gler ma facture\u201d button, meaning settle my bill. Salt appears as the sender, but the address isn’t the provider’s.<\/p>\n Branding can make a familiar recurring expense feel urgent. The message doesn’t need a dramatic threat if losing service would disrupt your day.<\/p>\n Before paying, check the real bill. If there is an actual overdue amount, resolve it through the provider’s genuine process rather than this email.<\/p>\n The published email also says recipients who already paid can ignore it while the account updates. That ordinary-sounding qualification can make the reminder feel less aggressive.<\/p>\n It still doesn’t authenticate the payment button. Criminals can include a reasonable explanation for a recent payment while directing everyone else to an imitation login.<\/p>\n If you know you paid, use your own receipt or statement to check it. Don’t enter the site merely to see which explanation it gives.<\/p>\n The destination resembles Salt’s customer sign-in page. It asks for credentials before presenting the next stage of the claimed billing task.<\/p>\n Entering them discloses account information to the criminals. The page’s familiar appearance doesn’t connect it to your real customer account.<\/p>\n If you typed a password and then stopped, the exposure still needs attention. You don’t have to reach the card page before acting.<\/p>\n Don’t retry with another password if the form seems not to work. Use the real provider’s recovery process to check your access.<\/p>\n After the imitation login, the story pivots. The site says a double debit occurred and a refund should be arranged.<\/p>\n The site now wants you to believe two charges occurred. Your bank hasn’t confirmed that simply because the next screen says so.<\/p>\n Check actual transactions before accepting the premise. If the alleged debits don’t appear in genuine records, don’t supply details to \u201ccorrect\u201d them.<\/p>\n Even if you have a real billing question, contact Salt independently. An unrelated genuine problem wouldn’t authenticate this particular refund page.<\/p>\n The process asks for personal information and then payment-card details. These submissions give the operators more than access to a telecom account.<\/p>\n A card can be exposed even if no charge appears immediately. Don’t wait for the promised refund or a visible loss before contacting its issuer.<\/p>\n The police advisory warns of unauthorized payments and further fraud. It doesn’t establish a fixed subscription, fee, or identical outcome for every recipient.<\/p>\n Report what you actually entered rather than guessing what the site might do. A password, card number, and identity document require different responses.<\/p>\n A password reset can protect the customer login going forward. It doesn’t withdraw card details already sent to another website.<\/p>\n Conversely, blocking the card doesn’t replace an exposed Salt password or secure another account where that same password was reused.<\/p>\n Make both reports where applicable: provider support for the login and bank or card issuer for the payment method.<\/p>\n Keep a record of each conversation. One organization’s case number shouldn’t be mistaken for confirmation that the other has already acted.<\/p>\n Use your known account route or a previously established provider contact. Find the billing period, amount, and actual payment status.<\/p>\n A real bill may exist even while a fake message is circulating. Don’t ignore genuine account obligations merely because this impersonation campaign exists.<\/p>\n If payment was recently made, ask the provider about its record rather than sending another amount through the questionable page.<\/p>\n Inspect the genuine bank or card statement independently. Compare completed transactions with pending entries, and ask your provider to clarify anything you don’t understand.<\/p>\n Don’t accept a screenshot or account summary supplied by the refund page as a substitute. The operators can display whatever supports the next request.<\/p>\n If you identify a real duplicate, resolve that specific transaction through the bank and provider. You still don’t need the unverified email’s website.<\/p>\n Keep the two supposed charges separate in your notes. Record whether each appears in the real statement or only on the suspicious page.<\/p>\n That avoids reporting an invented duplicate as an actual bank debit. It also helps the issuer identify any genuinely unauthorized transaction among normal account activity.<\/p>\n The promise of reimbursement doesn’t identify the recipient of your data. Confirm the organization and process before disclosing any payment information.<\/p>\n Salt’s official cost-control and fraud guidance<\/a> also advises against giving sensitive financial details in response to incoming calls.<\/p>\n Apply the same independent check if someone phones afterward about the alleged error. Knowledge of a billing concern doesn’t prove who controls the call.<\/p>\n Reach Salt through the real app, account, or established support route. Tell staff that a phishing page received your credentials.<\/p>\n If you still have access, review available contact and account information for changes. If not, request recovery through the legitimate provider.<\/p>\n For a family plan or company-managed subscription, involve the actual account holder. A second person may need to help verify details or prevent duplicate actions.<\/p>\n Don’t approve a security code merely because someone says it is needed to repair the account. Confirm the action with the genuine service first.<\/p>\n Use a new password that isn’t shared with other logins. Changing one character in a reused password leaves your accounts needlessly connected.<\/p>\n Document changes you didn’t make before correcting them with support. Those details can help explain what happened after the credentials were exposed.<\/p>\n Stop the supposed refund.<\/strong> Leave the website and don’t provide extra information to make the reimbursement \u201cfinish.\u201d<\/p>\n Save the email, subject, received time, and destination already in your records. Avoid another visit to gather information the real providers haven’t requested.<\/p>\n<\/li>\n Contact the card issuer if you entered a card.<\/strong> Explain that its details were supplied to a fake Salt refund page.<\/p>\n Ask about blocking or replacing the card and reviewing transactions. A missing immediate charge doesn’t establish that the details remain safe.<\/p>\n<\/li>\n Reset the exposed Salt login.<\/strong> Start through the genuine service, not the phishing email or a new reset message sent by its operators.<\/p>\n If that password was used elsewhere, replace it on those accounts too. Give priority to email and financial services using the same credentials.<\/p>\n<\/li>\n Have Salt check the real billing position.<\/strong> Confirm actual unpaid amounts or duplicate payments independently so the fraud doesn’t leave a genuine issue unresolved.<\/p>\n Ask support about unauthorized account changes. Don’t pay a stranger to keep the service active while the provider reviews your report.<\/p>\n<\/li>\n Report any completed payment accurately.<\/strong> Tell the bank the amount, merchant or beneficiary, time, and any approval you made.<\/p>\n Ask about the available dispute or recovery process. Don’t promise yourself a refund based on the fake page’s status message.<\/p>\n<\/li>\n Check additional exposure without assuming infection.<\/strong> If you downloaded or opened unexpected software, seek trusted help and consider checking the device with Malwarebytes.<\/p>\n AdGuard may reduce access to known scam pages. These tools don’t block a card on your behalf or erase a password already collected.<\/p>\n<\/li>\nA supposed duplicate debit creates a second request for information<\/h3>\n
\n
Verify the bill and the refund through independent records<\/h3>\n
Why the Change From Debt to Refund Can Keep You Engaged<\/h2>\n
How the Salt Invoice Scam Works<\/h2>\n
Step 1: A failed-payment notice threatens service interruption<\/h3>\n
Step 2: The button leads to a copied account login<\/h3>\n
Step 3: The page claims the bill was charged twice<\/h3>\n
Step 4: A refund form collects personal and card details<\/h3>\n
Step 5: The account and payment exposures need separate containment<\/h3>\n
Check the Two Billing Claims Separately<\/h2>\n
Was a real Salt bill unpaid?<\/h3>\n
Did your bank actually show a duplicate payment?<\/h3>\n
Who is asking for the card information?<\/h3>\n
Keep the Genuine Account Usable While You Respond<\/h2>\n
What to Do if You Have Fallen Victim to This Scam<\/h2>\n
\n