Ricardo data breach: scammers are using WhatsApp now – here’s how to stay safe
A WhatsApp message from Ricardo including your name and address? It’s the newest way criminals are trying to gain your trust in the wake of Ricardo’s data breach. But that’s just one of many clever scams. Here’s how to recognise them.
Your name’s correct, so is the address. Even the phone number connected to the WhatsApp message looks like it’s from Switzerland. According to the scammers, Ricardo has apparently detected suspicious activity on your account. All you have to do is click on a link and confirm your information. Sound plausible? Well, that’s exactly what scammers are counting on.
As reported by «Bote der Urschweiz» (article in German), several such WhatsApp messages have already made the rounds. Among other things, scammers have posed as the Ricardo Help Center and used their victims’ actual personal information. However, the link doesn’t lead to Ricardo, but to a third-party website that imitates the Swiss auction platform’s site.
Fraudsters are trying to time their attempts with a massive data breach (article in German) at the Swiss online marketplace. On 7 October, Ricardo discovered a security vulnerability that allowed unauthorised individuals to access the names, mailing addresses and phone numbers of approximately 890,000 user accounts. This flaw has since been patched, and users affected were notified by e-mail. It hasn’t been proven yet whether the WhatsApp messages actually contain data related to this incident.
Why this scam is so dangerous
Here’s the scary bit: criminals don’t necessarily need to know your password right away to hack your account. Just your name, address and phone number are enough to make a message seem genuine. Anyone who can accurately reproduce personal details will quickly appear like an actual Ricardo employee. Anyone who doesn’t realise this and enters their information on the fake website unwittingly reveals all their other login credentials.
This is known as phishing. Criminals try to lure you to fake websites using messages that are fake but sound credible. Once there, you’re tricked into entering your passwords, credit card information or other sensitive information. With the stolen information, attackers can then take over your accounts or even steal money from them.
On its official help page (page in German), Ricardo warns of other scams involving supposedly blocked payments, fake delivery services or requests to confirm a payment via QR code.
It’s not just Ricardo: some more scams to be wary of
A glance at Booking.com shows that fraud attempts such as these aren’t a problem specific to Ricardo. As reported by the National Cyber Security Centre (NCSC), criminals regularly gain access to the accounts of real hotels and contact their guests directly through the booking platform’s official messaging system. They’ll claim your credit card needs to be verified again; otherwise, your reservation will be cancelled. What makes this particularly insidious is that, since the messages actually come through Booking.com and even the booking details are correct, they seem extremely credible.
Another scam involves fake package notifications. The scammers claim the post office or some other delivery service was unable to deliver a package because the address was incomplete or a small fee was still outstanding. Anyone who clicks on the link included in the e-mail will be taken to a fake website designed to steal payment information. In some cases, criminals even go a step further. The NCSC has already documented instances in which fake pickup notices with tampered QR codes ended up directly in people’s mailboxes.
Source: National Cyber Security Centre (NCSC)
Banks are also regularly appropriated as a front. In these scams, people posing as bank employees will call and claim to have discovered a suspicious payment. To protect their money, recipients of these calls are asked to provide security codes, confirm a payment or install remote maintenance software. Sometimes the display even shows the bank’s actual phone number – even though the call’s coming from criminals.
The name Digitec Galaxus is also being misused in connection with fraud attempts. As my colleague Manuel Wenk reported, criminals sent fake e-mails on behalf of Galaxus. In them, they promised a free bottle of perfume in exchange for participating in a customer satisfaction survey. Anyone who took part was directed to a deceptively realistic replica of the Galaxus website, where they were asked to enter their credit card information to pay a small shipping fee. However, the supposed gift was just a ploy to obtain sensitive payment information.
There are countless variations of these scams, but the basic principle remains the same. By using believable stories and creating a false sense of urgency, scammers try to trick people into revealing sensitive information. In any case, the days when phishing was mainly associated with poorly translated e-mails from a supposed Nigerian prince who wanted to transfer millions to you are long gone. Today, criminals are much more sophisticated – and are harder to detect as a result.
How to protect yourself
The most important rule: don’t trust a message just because the sender knows your name or address. Ricardo, for example, recommends the following precautions in this particular case. However, most of these apply just as well to other platforms and online services. They can protect you from entirely different scams too.
- Don’t open any links or QR codes from WhatsApp messages, especially if you’re asked to verify your identity or enter payment information. Instead, open Ricardo yourself in your browser or through the app.
- Be wary of WhatsApp and text messages: Ricardo doesn’t handle purchases and sales through these channels. Even a supposed customer service representative who contacts you there is instantly suspect.
- Check the website address: Genuine Ricardo pages can be found at www.ricardo.ch, login.ricardo.ch and help.ricardo.ch. Just because an address happens to include the name Ricardo somewhere doesn’t mean it’s genuine.
- Never provide card or bank information to receive a payment: To receive money from a sale, you won’t need to disclose your credit card information, your Twint or your online banking login details. Don’t let SMS confirmation codes fall into the wrong hands either.
- Report suspicious messages: use the official Ricardo fraud reporting form (page in German) to do so.
What if you’ve already clicked the link?
If you’ve simply opened a suspicious website, close it and don’t enter any information. If you’ve already entered your Ricardo password, change it immediately on the official website. If you use the same password elsewhere, you should change it there as well. And make sure to use a different one than the one you use on Ricardo. Knowing that many people use the same password for multiple accounts out of convenience, criminals often try stolen passwords in other places as well.
If you’ve entered credit card, Twint or e-banking information, however, every minute counts. Contact your bank or payment provider immediately and have the affected accounts or cards blocked if necessary. If you’ve uploaded personal documents or have already fallen victim to fraud, Ricardo also recommends filing a police report.
At least there’s one bit of good news: according to Ricardo, neither passwords nor e-mail addresses were exposed in the data breach. You won’t need to change your password just because of this incident. Do still remain alert, though. After all, the greatest danger right now isn’t necessarily the stolen data itself. The things scammers can make you believe are much more insidious.
I write about technology as if it were cinema, and about films as if they were real life. Between bits and blockbusters, I’m after stories that move people, not just generate clicks. And yes – sometimes I listen to film scores louder than I probably should.
Interesting facts about products, behind-the-scenes looks at manufacturers and deep-dives on interesting people.
Show all
