![\"Original](\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2026\/10\/migros-food-box-survey-card-scam-original-email.webp\" "\\"\\"")
<\/figure>\nOverview<\/h2>\nThe food box is bait for a fraudulent ordering page<\/h3>\n
The Migros food box scam impersonates the Swiss retailer with a survey reward. Selected customers are supposedly entitled to groceries valued at CHF 49.90.<\/p>\n
That amount is the claimed value of the gift, not a verified price or the amount each recipient will be charged.<\/p>\n
Zurich cantonal police’s September 16 warning<\/a> identifies the email, imitation survey, and fraudulent order page. This is a documented phishing campaign.<\/p>\n The original email above was published with identifying details masked. The retailer’s branding doesn’t mean Migros organized the offer or operates the destination.<\/p>\n The questions concern shopping habits, Migros products, the Cumulus card, and the app. Completing them makes claiming the box feel like the final step.<\/p>\n The next page asks for contact and delivery details, followed by a small payment. The email itself frames this as a contribution toward shipping.<\/p>\n Police warn that a larger amount may be charged and the card may be used for further paid services. Don’t treat the visible fee as a loss limit.<\/p>\n The warning doesn’t establish one universal subscription, billing interval, or final charge. Those details shouldn’t be invented to make the story sound worse.<\/p>\n Don’t claim the box through this email. Verify genuine offers through Migros independently, and contact the card issuer if payment details were entered.<\/p>\n A grocery box is a practical gift. You don’t need to believe you’ve won a fortune to feel that a retailer might reward a few customers.<\/p>\n The reserved label adds a sense that the decision has already been made. You appear to be collecting something assigned to you, not entering a competition.<\/p>\n Then the survey gives you a task that seems to explain the reward. Your feedback is presented as what earns the box.<\/p>\n By the time payment is requested, you’ve already spent time answering questions and supplying details. Abandoning the process can feel like wasting that effort.<\/p>\n But completing a questionnaire doesn’t authenticate the person asking for a card. Your effort is not evidence that a real retailer owes you groceries.<\/p>\n The subject matter helps too. Questions about Cumulus and the Migros app sound informed because they refer to services customers recognize.<\/p>\n Those subjects can be copied into an unauthorized survey. Knowing the retailer’s products isn’t the same as acting on the retailer’s behalf.<\/p>\n The sensible stopping point is before payment information leaves your control. You can pause a supposedly reserved reward without paying to preserve your place.<\/p>\n The sender presents itself as Migros customer service. It promises a box with a claimed value of CHF 49.90 after participation in a short survey.<\/p>\n The original example uses orange branding, a grocery-box image, a reference field, and a prominent survey button. The publisher has obscured identifying details.<\/p>\n The pictured summary labels the box free and reserved. Those words can make the offer feel personalized without proving that Migros selected you.<\/p>\n A reservation label is easy for the page to display. It doesn’t establish that groceries are being held, dispatched, or supplied by the real retailer.<\/p>\n It also mentions a small shipping contribution while describing the reward as free. Read those two statements together rather than remembering only the word gift.<\/p>\n A reference number and product picture don’t identify the operator. They can make the invitation look specific without connecting it to your genuine customer account.<\/p>\n The button opens an imitation Migros page. Recipients answer questions about shopping, products, the Cumulus card, and the app.<\/p>\n These questions create a coherent story: you’re providing useful customer feedback, and the box is your thank-you.<\/p>\n The dangerous leap is assuming that a relevant question proves who asked it. A fraudulent site can discuss a real retailer accurately.<\/p>\n Don’t submit additional account details to prove you qualify. The police warning concerns the reward funnel, not a verified Migros eligibility check.<\/p>\n After the survey, the page says the box can be claimed. Limited availability and apparent interest from other people add time pressure.<\/p>\n That makes checking elsewhere feel like a risk to the reward. In practice, you’re being hurried before the payment destination has been verified.<\/p>\n A countdown or stock statement on a fake page isn’t an independent inventory record. You don’t need to outpace other claimants to protect yourself.<\/p>\n Leave the page and check through the real retailer. If the offer cannot survive independent verification, don’t fund it to avoid missing out.<\/p>\n The apparent ordering stage requests a name, address, phone number, and email address. These fields resemble what a real grocery delivery would need.<\/p>\n That practical appearance doesn’t change who receives them. On the fraudulent page, those details are supplied to its operators.<\/p>\n If you stopped after the address form, don’t dismiss the incident because you never paid. The contact information can still support later targeted messages.<\/p>\n Watch for an unexpected confirmation, delivery problem, or invoice that repeats those details. Familiar information doesn’t authenticate the next sender.<\/p>\n The supposed gift now requires a small payment. A card form makes that amount look like a minor condition rather than a new purchase decision.<\/p>\n Police warn that entered card details can lead to higher charges or additional paid services. The small amount displayed isn’t a reliable cap.<\/p>\n Don’t infer a specific recurring plan without seeing its actual terms. The established reason to stop is the confirmed fraudulent collection of personal and payment information.<\/p>\n If you already supplied a card, contact the issuer before waiting to see whether a box arrives. Delivery speculation shouldn’t delay payment protection.<\/p>\n Open Migros through the app or website you already use. Ask the genuine retailer about the exact promotion if you can’t verify it there.<\/p>\n Don’t use the survey page’s support link as proof. The person operating the questionable offer can also operate its apparent help desk.<\/p>\n A customer-service label, logo, or reference field isn’t enough. You want confirmation from a route that wasn’t chosen by the email.<\/p>\n Cumulus and retailer apps can appear in legitimate customer activity. Their names can also be included in a fake form without permission.<\/p>\n Don’t disclose your real account password or a security code to establish that you’re a customer. That would create another exposure beyond the survey.<\/p>\n Migros provides official account help<\/a> for genuine login questions. Use that service only where an actual account issue needs attention.<\/p>\n CHF 49.90 describes what the sender says the groceries are worth. It doesn’t tell you the total risk of entering a card.<\/p>\n A tiny shipping fee looks attractive beside CHF 49.90 worth of groceries. That comparison only matters if the retailer actually made the offer.<\/p>\n If an unexpected banking approval appears, read the amount and merchant carefully. Never supply a code merely because the page calls it a delivery confirmation.<\/p>\n Keep a record of what you submitted and where you stopped. You may need to explain a later message that repeats the same details.<\/p>\n Be alert for unusual orders or invoices in your name. Police specifically warn recipients about this after address information is disclosed.<\/p>\n Don’t pay an unfamiliar invoice simply because it contains the correct address. Verify the claimed order and merchant through independent records.<\/p>\n If you didn’t create a real order, say so when reporting it. A fraudulent page’s confirmation isn’t your evidence that a valid purchase occurred.<\/p>\n For a shared household email or card, tell the other authorized users about the offer. Somebody else may otherwise treat a follow-up as routine delivery administration.<\/p>\n You don’t need to change every unrelated account because an address was entered. Focus on the information actually shared and any suspicious activity that follows.<\/p>\n If you also created a password on the fake page, don’t reuse it anywhere else. Replace it on any genuine account where it was already used.<\/p>\n Stop the reward claim.<\/strong> Don’t pay another delivery charge or provide extra data because the box is supposedly about to be released.<\/p>\n Save the email and the available order or payment evidence. Avoid returning to the form to see how far it lets you proceed.<\/p>\n<\/li>\n Tell the card issuer about the fraudulent form.<\/strong> If you entered card information, ask promptly about blocking or replacing the affected payment method.<\/p>\n Explain whether you approved any banking request and what amount you expected. Don’t wait for groceries before reporting an exposed card.<\/p>\n<\/li>\n Review actual charges and further billing.<\/strong> Look at genuine statements for the small advertised amount, larger charges, and unfamiliar additional services.<\/p>\n Ask the issuer how to dispute unauthorized entries and prevent further billing. A replacement card alone shouldn’t be assumed to settle every possible payment arrangement.<\/p>\n<\/li>\n Preserve any terms or receipts already received.<\/strong> If the process claimed a paid service or subscription, keep that wording and the transaction descriptor.<\/p>\n Don’t invent a plan or renewal date when reporting it. Tell the provider what appeared and ask what action applies to the actual charge.<\/p>\n<\/li>\n Secure credentials only where they were exposed.<\/strong> If you supplied a genuine account password, change it through the real service and address any reuse.<\/p>\n Use official Migros account help if needed. The published food-box mechanism doesn’t establish that every participant disclosed a loyalty-account login.<\/p>\n<\/li>\n Assess files or software separately.<\/strong> If another step caused an unexpected download or installation, get trusted assistance and consider a Malwarebytes check.<\/p>\n AdGuard can help reduce access to known harmful sites. Neither tool cancels a paid service or recovers information already submitted to the offer.<\/p>\n<\/li>\nThe survey prepares you to accept a small payment<\/h3>\n
\n
The displayed small fee doesn’t limit the risk<\/h3>\n
Why This Looks Like a Customer Reward Rather Than a Sale<\/h2>\n
How the Migros Food Box Scam Works<\/h2>\n
Step 1: An email offers a reserved grocery box<\/h3>\n
Step 2: The questions make the offer feel retailer-specific<\/h3>\n
Step 3: Scarcity pushes the gift toward an immediate order<\/h3>\n
Step 4: The delivery form collects your contact information<\/h3>\n
Step 5: A small fee opens a larger financial exposure<\/h3>\n
What to Check Before Trusting a Survey Reward<\/h2>\n
Separate the retailer from the sender<\/h3>\n
Separate a real loyalty program from a copied questionnaire<\/h3>\n
Separate the claimed gift value from the payment<\/h3>\n
If You Gave an Address but Stopped Before the Card<\/h2>\n
What to Do if You Have Fallen Victim to This Scam<\/h2>\n
\n