Cyber Fraud: Possibilities and Limitations of Asset Recovery

Bern, September 25, 2026

If money has already been transferred as a result of online fraud, the options for recovering it are often limited. In the case of payments made abroad or via cryptocurrencies, the prospects are generally even slimmer. The prospects for recovery depend primarily on whether the flow of funds can still be traced and leads to a specific account, a person, a financial intermediary, or other tangible assets. If such leads are located in Switzerland or in a country where investigative and asset-freezing measures can be effectively implemented, the prospects for recovery are significantly better.

The Most Important Factor for Potential Recovery

If money has already been lost, the following steps are particularly important for your chances of recovering it:

• Do not make any further payments.
• Notify your bank immediately about the suspected fraud and have them check whether the payment can still be reversed.
• If possible, also notify the receiving bank of the suspected fraud as soon as possible.
• Keep as detailed a record as possible of when each amount was transferred and where it went. Save chats, payment receipts, and other digital records.
• File a criminal complaint and include any known accounts, individuals, platforms, and other specific details.

If you have already lost money, you can use the preliminary assessment worksheet below to compile the most important information regarding payments, accounts, wallets, and known parties involved. It will help you document the flow of funds and identify any existing connections.

1. Contact the bank immediately

If money has been transferred, you should immediately notify your bank of the suspected fraud. Ask them to check specifically whether the payment can still be stopped or reversed.

However, a payment recall does not guarantee a refund. If a transfer has already been credited to an account at another bank, a reversal generally requires that the funds are still available and that the recipient agrees. In the case of a clear allegation of fraud, however, your own bank may try to persuade the recipient’s bank to freeze the funds until an official order is issued.

If the recipient bank is known , it may be advisable to notify it directly of the suspected fraud, the affected account, and the specific transaction. However, such a notification does not guarantee that the account will be frozen and is not a substitute for a seizure under criminal procedure.

For a Swiss or Liechtenstein IBAN, the account-holding institution can be identified based on the bank identifier included in the IBAN. SIX provides a free IBAN validator for this purpose:

SIX – IBAN Validator

It should be noted, however, that a CH-IBAN does not always mean that the recipient has their own account at a Swiss bank. In the case of so-called virtual IBANs, the payment may be processed through a payment service provider or a pooled account. In such cases, the query may only show the intermediary Swiss institution.

For foreign IBANs, an international IBAN validator can help identify the country and, in many cases, the bank involved.

IBAN.com – Check IBAN

If you paid with a credit or debit card, you should also immediately dispute the charge with the card issuer and ask about the chargeback process. The deadlines can be short. For example, with various Swiss card issuers, disputes must be filed within 30 days of the billing date; however, longer deadlines may apply depending on the reason for the claim. Therefore, do not wait until the fraud case has been fully resolved.

2. Document the cash flow

For each payment, make a note of the date and time, amount, and currency, as well as the recipient’s account number or IBAN, bank or payment service provider, and the payment reference, if possible. Even simple screenshots can be helpful.

A TWINT payment can also serve as a concrete lead for an investigation. For payments between individuals, the mobile phone number and name of the contact are used in particular and displayed in the transaction data. Therefore, be sure to save the transaction details and the contact information displayed.

For cryptocurrencies, the blockchain, wallet address, and transaction hash (or TXID) should also be documented.

Names, profiles, and companies may be fictitious. Transactions that have actually taken place, on the other hand, leave objective traces.

These leads may point to a bank, a payment service provider, a cryptocurrency exchange, or an identifiable individual, and thus serve as a starting point for further investigation.

When money is deposited into your account

If you are asked to accept money on behalf of another person and then forward it, stop these transactions immediately. These so-called financial agents or “money mules” are often used to launder fraudulently obtained funds.

Do not transfer received funds on your own initiative—not even to someone who claims to have made the payment by mistake. Instead, notify your bank and the police. Any refund should be processed through the bank. People who forward such funds may themselves come under suspicion of money laundering under certain circumstances.

3. Preserving Digital Evidence

Keep as complete a record as possible of the perpetrator’s chats, voice messages, and emails. Also save phone numbers, usernames, URLs, and domain names, as well as payment receipts, contract documents, and screenshots of the platform used.

Wallet addresses and transaction data should also be copied and saved. This allows them to be reused later without transcription errors.

If copies of identification documents, passwords, or remote access are involved

If you have shared passwords, bank information, copies of identification documents, or other personal records, you should keep an eye not only on your finances but also on the possibility of identity theft.

Change any affected passwords from another, trusted device, log out of any open sessions, and enable two-factor authentication, if available. If remote maintenance software has been installed, you should stop using the affected device for online banking or other sensitive applications and, after securing any potential evidence, have it examined by an expert.In the event of a possible data breach, it is also advisable to notify the affected financial service providers and monitor your accounts for unusual activity.

If a copy of your ID has been shared and there are signs of identity theft, it may also be a good idea to request a self-disclosure report from credit bureaus. For example, CRIF allows you to check once a year, free of charge, what personal data they have on file about you.

4. File a criminal complaint with specific details

File a criminal complaint with the police. Through Suisse ePolice , you can find the appropriate police station. Depending on the canton, certain offenses can also be reported online. If in doubt, call ahead to clarify the best way to file the report and what documents are required.

Regardless of whether you file the report in person, in writing, or online, you should be sure to have on hand, in particular, a summary of payments, bank or credit card statements, details of recipient accounts or wallets, and the most important communication and contact information for the individuals or platforms involved. The more clearly you organize this information, the easier it will be for the police to identify specific leads for their investigation.

Concrete leads are particularly helpful for the investigation:

• Which bank received the money?
• What name was listed as the payee?
• Which crypto exchange was used for the transaction?
• What phone numbers, email addresses, or accounts were used?

The more concrete the lead, the more readily law enforcement can act on it. A known Swiss recipient account can provide a concrete starting point for an investigation: Bank records can be used to identify the account holder, after which it can be determined what further investigative or protective measures are warranted.

The situation is different if no specific point of entry is identifiable—such as an identified account, a known individual, or a financial intermediary from whom further information or assets might be obtained. If the trail leads only through multiple foreign accounts, platforms, or wallets without such a point of connection, the investigation quickly reaches practical limits. In such cases, it is not sufficient that further inquiries might still be theoretically possible. There must also be a realistic prospect of identifying the perpetrators, the further flow of funds, or any remaining assets (see Federal Supreme Court 7B_567/2024 of April 22, 2026; 7B_868/2025 of August 5, 2026)

For you, this means: The more precisely you can identify accounts, wallets, platforms, payment service providers, and the individuals involved, the better the chances are that this will lead to concrete investigative or protective measures.

Your Rights in Criminal Proceedings

If criminal proceedings are initiated, you may participate in them as a private prosecutor. The relevant statement must be submitted no later than the conclusion of the preliminary proceedings. As a party to the proceedings, you generally have the right to inspect the case file, submit motions for evidence, and assert civil claims arising from the criminal offense in the criminal proceedings.

You can also help ensure that any remaining assets are secured by providing the public prosecutor’s office with specific accounts or other assets and requesting that they be investigated. The competent criminal justice authority will decide whether to order a seizure.

Pay special attention to short deadlines for filing appeals. If a proceeding is not initiated, is suspended, or is dismissed, the deadline for filing an appeal against such a decision is generally only ten days.

The Federal Supreme Court decision 7B_567/2024 of April 22, 2026, shows that filing a complaint can be worthwhile.

Claims Outside of Criminal Proceedings

If the holder of a Swiss recipient account has been identified, civil claims may be considered, such as those arising from tort or unjust enrichment. These claims can be enforced through debt collection proceedings, secured, if necessary, by an attachment.

5. Beware of the second scam

After falling victim to an investment or crypto scam, victims are often contacted again. Individuals claiming to represent government agencies, law firms, or “recovery services” then assert that they have found or already recovered the lost funds. To release the funds, victims are first asked to pay fees, taxes, attorney’s fees, or other upfront payments.

These so-called “recovery scams” specifically capitalize on the loss the victim has already suffered. The perpetrators know that the prospect of getting the lost money back can be particularly persuasive. In some cases, they use the names of government agencies or international organizations and present documents that appear professional.

Recovery scammers often pose as law firms. In some cases, they even use the names and photos of real lawyers.

Further Reading: BACS – When Fraudsters “Recover” Lost Funds

6. When might it be advisable to seek legal assistance?

A lawyer cannot recover missing funds simply by being retained to pursue the recovery. If the funds were transferred through unknown foreign accounts or unidentifiable wallets and there are no longer any tangible leads, even an investigation by a lawyer often does not provide any economically meaningful added value.

Unfortunately, this is often the case with many inquiries we receive regarding cyber fraud incidents. If we don’t see any realistic grounds for action, we say so openly.

The situation may be different if the available documents reveal specific leads—such as a Swiss recipient account, an identifiable individual or company, a bank, a cryptocurrency exchange, or another financial intermediary. In such cases, it may be advisable to analyze the flow of funds more closely and determine what legal steps still need to be taken.

We have already had cases in which a specific defendant could be identified in this way and lost funds were recovered. In each case, the decisive factor was not the involvement of an attorney per se, but rather the existence of a tangible point of connection that could be used as a legal basis.

7. Frequently Asked Questions

Can my bank reverse a fraudulent transfer?

Only under certain circumstances. If the money has already been credited to the recipient’s account, your bank cannot simply reverse the payment on its own. However, if there is a clear suspicion of fraud, your bank can try to contact the recipient’s bank and arrange for any remaining funds to be temporarily frozen. The sooner you act, the better.

How can I find out which bank holds a recipient’s account?

For a Swiss or Liechtenstein IBAN, the financial institution involved can be identified using the SIX IBAN checker. However, in the case of virtual IBANs, a payment service provider may act as an intermediary; therefore, the bank displayed is not necessarily the one that maintains the actual customer relationship with the recipient.

Is it worth filing a criminal complaint if the money was transferred abroad?

Yes. With international payments, the chances of recovering the funds are often lower. However, filing a criminal complaint makes it possible to bring the facts of the case to the attention of law enforcement authorities and have them investigate known accounts, individuals, or other leads. It can also serve as evidence of the reported fraud when dealing with banks, insurance companies, or other agencies.

Is there a deadline for filing a criminal complaint?

In cases of ordinary fraud, there is no short deadline for filing a criminal complaint because the offense is generally prosecuted ex officio. Exceptions apply, in particular, to fraud committed to the detriment of relatives or family members. Regardless of this, criminal statutes of limitations apply. However, you should not wait to take action to recover your funds: The more time that passes, the more likely it is that funds will be transferred elsewhere or that evidence will become harder to trace.

Are cryptocurrencies permanently lost after a scam?

Not necessarily. Transactions on public blockchains generally remain traceable. What is particularly relevant in practice is whether the trail leads to an identifiable cryptocurrency exchange, an individual, or another intermediary that has access to customer data or controls assets.

How can I spot a recovery scam?

A typical scenario involves an unsolicited contact from a purported government agency, law firm, or debt collection agency. This entity claims to have found your money but demands fees, taxes, or other upfront payments before making a payment. Do not make any such payments, and verify the identity of the organization in question independently—not through the phone numbers or links provided in the message you received.

8. Important Resources and Links

BACS – Financial Loss: Guidance from the Federal Office for Cybersecurity on how to proceed following a financial cyber incident.
BACS – Financial Loss

Suisse ePolice: Find the appropriate police station and—for certain offenses—file a police report online.
Suisse ePolice

Cybercrime Police: Information on current cyber trends and how to report a cyber incident. If financial loss has occurred, such a report does not replace filing a criminal complaint with the police.
Cybercrimepolice – Ereignis melden

Swiss Banking Ombudsman: Case study on the recovery of payments and the possibility of contacting the receiving bank in cases of clear suspicion of fraud.
Banking Ombudsman – Recovery of Funds in Cases of Suspected Fraud

As of September 2026. This article provides a general overview for Switzerland and is not a substitute for an assessment of individual cases.