![\"Original](\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2026\/10\/fake-ewz-refund-twint-code-scam-original-sms.webp\" "\\"\\"")
<\/figure>\nOverview<\/h2>\nThe caller and website are working toward the same deception<\/h3>\n
The fake ewz refund scam combines a convincing phone conversation with an SMS link and counterfeit web pages.<\/p>\n
According to the Swiss police warning about ewz impersonation<\/a>, the route ultimately seeks information and a verification code for TWINT account takeover.<\/p>\n The real electricity provider, ewz, and the genuine TWINT service are being impersonated. Neither is the operator of the fraudulent call or linked website.<\/p>\n Police describe several pretexts, including overpayment refunds, customer-information updates, verification, and supposed security checks. The exact opening can change.<\/p>\n The text shown here is an original campaign message published by police. It refers to the phone conversation and supplies a link, with identifying details redacted.<\/p>\n The caller tells you to expect a text. When it arrives, the link can feel like official paperwork supporting the conversation you’ve just had.<\/p>\n Pause when a conversation about electricity turns into a request for banking information or a TWINT authentication code.<\/p>\n An unsolicited link is easier to question when it arrives alone. During a conversation, someone has already explained why you’re supposedly receiving it.<\/p>\n The timing can feel like confirmation. They said a message would arrive, it did, and now they seem ready to help with the next screen.<\/p>\n But the same person can arrange both parts. Two connected communications don’t become independent evidence simply because one is spoken and the other is written.<\/p>\n A patient tone can also make the interaction comfortable. You may feel you’re dealing with an employee who understands a confusing administrative task.<\/p>\n You don’t need to decide whether the voice sounds professional. You need a separate way to establish who is requesting the action.<\/p>\n Tell the caller you’ll contact the provider yourself. A genuine issue can be checked through an official channel after the incoming conversation ends.<\/p>\n Don’t allow an objection to that pause to become your reason for staying. Your ability to verify a request matters more than the caller’s explanation of urgency.<\/p>\n The callers impersonate ewz staff and can manipulate the displayed number. A Swiss-looking or apparently familiar caller ID therefore isn’t reliable identification.<\/p>\n The opening story creates a reason to cooperate. A refund makes help attractive; an update or security check makes delay seem unwise.<\/p>\n Either way, the caller is asking you to accept their explanation before you have reached the real utility independently.<\/p>\n Don’t disclose more information to help them prove who they are. Verification should not begin with supplying the account secrets you’re trying to protect.<\/p>\n The caller sends a link and offers guidance. Opening it keeps you within the process they introduced.<\/p>\n Once they’re describing buttons and screens, it can become awkward to pause. You may concentrate on following instructions correctly rather than evaluating the destination.<\/p>\n You can stop without finishing the screen. Don’t continue merely because the caller says leaving will interrupt a refund or lock an account.<\/p>\n Save the message if it’s already on your phone. It may help explain the incident later without requiring another visit to the page.<\/p>\n The linked site resembles ewz, then presents a supposed transition to TWINT. Police say the route remains inside the fraudulent infrastructure.<\/p>\n A different logo or loading screen can make that transition seem like a handoff between legitimate organizations. It isn’t evidence that either organization accepted the session.<\/p>\n Watch the purpose of the task. An alleged electricity adjustment has now become a reason to interact with a payment-account page.<\/p>\n Don’t accept that change simply because the caller narrates it smoothly. Check the utility question and payment-account question through their respective genuine providers.<\/p>\n The false TWINT page asks for information associated with the account. Choosing a bank can make it feel tailored to your situation.<\/p>\n However, a menu of real banks doesn’t mean any of those banks controls the form. An impostor can list legitimate names.<\/p>\n Stop before adding more details to correct an apparent mismatch. You don’t need to identify the perfect selection for a page you haven’t authenticated.<\/p>\n If you’ve already answered, note which information was supplied. Describe the actual questions to genuine support rather than assuming they were harmless eligibility checks.<\/p>\n The code is the critical access step. Police warn that the collected information can enable takeover and transactions in the account holder’s name.<\/p>\n A code arriving on your own phone doesn’t make the requesting page trustworthy. Another person may be trying to complete an operation involving your account.<\/p>\n Don’t read it aloud, paste it into the linked form, or send a replacement after the caller says it expired.<\/p>\n If you already supplied it, end the interaction and contact the appropriate TWINT provider promptly. Don’t wait for the caller to confirm that anything happened.<\/p>\n TWINT’s own security guidance<\/a> tells users to keep SMS codes private and warns about impostors requesting sensitive information.<\/p>\n This is a practical boundary you can apply without judging the caller’s personality. Someone asking for access secrets is not entitled to them because they’re helpful.<\/p>\n It also prevents confusion about the word verification. A code can verify an operation for the service while being described to you as a routine customer check.<\/p>\n Read the original message for yourself. Don’t let a caller’s instructions replace the explanation displayed by the real financial service.<\/p>\n If a genuine app shows an operation, examine its purpose, recipient, and amount where applicable. Don’t approve an outgoing action as a way to collect money.<\/p>\n You can refuse the instruction and still investigate whether the utility owes a refund. Those decisions don’t need to happen inside the same conversation.<\/p>\n Not every TWINT app has the same support route. Know whether you’re using a bank-issued app or TWINT Prepaid.<\/p>\nA refund is one story the caller may use<\/h3>\n
A utility issue shouldn’t cost you control of a payment account<\/h3>\n
\n
Why a Text Sent During a Call Feels Different<\/h2>\n
How the Fake ewz Refund Scam Works<\/h2>\n
Step 1: A familiar-looking number supports the utility story<\/h3>\n
Step 2: The SMS turns the conversation into a web session<\/h3>\n
Step 3: A cloned utility page gives way to a false payment portal<\/h3>\n
Step 4: Bank selection and personal questions make the portal seem specific<\/h3>\n
Step 5: The verification code puts account access at risk<\/h3>\n
Check What TWINT Actually Says About Secret Codes<\/h2>\n
Contact the Right TWINT Provider After a Disclosure<\/h2>\n