BACS identifies over 10,000 phishing websites in 2023
The Anti-Phishing Report 2023 from the Federal Office for Cybersecurity (formerly NCSC) analyzed more than 500,000 reports. Most fraudsters lure their victims with well-known brand names.
Last year, the BACS (formerly NCSC) received and analyzed around 554,000 reports of phishing. From these, 10,007 websites were finally identified as phishing websites and the website operators were informed. In the current anti-phishing report, the BACS provides an insight into the analysis and information on the most frequently abused brand names and domains. The report also provides the most important measures and recommendations for protection against phishing.
The BACS receives reports of phishing via various channels: On the one hand via the platform antiphishing.chwhere phishing websites or emails with phishing links can be reported. On the other hand, if the reporters wish to receive a response, via the Registration form.
Attackers use phishing to try to obtain sensitive data such as access data for email, e-banking or social media accounts or even credit card information.
10,007 phishing websites identified
In 2023, the BACS, formerly the NCSC, received a total of 544,367 reports via the "antiphishing.ch" platform. In addition, 9395 phishing reports were received via the reporting form in the same period.
As phishing websites are often reported to BACS more than once, they are first processed automatically to remove duplicates. After this clean-up, 10,007 websites were finally identified as phishing websites last year. This corresponds to an increase of 10% compared to the previous year (2022). The BACS informed the operators of the websites so that they could take the necessary measures as quickly as possible. In addition, it proactively shares information on active phishing websites with partners in Switzerland and abroad, including web browser manufacturers and spam filters.
Focus on mail and parcel suppliers
The 2023 identified phishing websites misused 260 different brand names, with 61.1% of the reported phishing websites misusing Swiss brand names and 33.1% misusing names of foreign brands. 5.8% of the phishing websites did not abuse any explicit brand names.
Together with foreign providers, phishing websites that misuse the brand names of well-known letter and parcel delivery companies account for over 40%. At 21%, the Swiss Post brand name was misused the most by cybercriminals for phishing in 2023.
The majority of phishing websites are operated on foreign top-level domains (TLDs). Almost half of all identified phishing websites were operated on the TLDs ".com" and ".net".
Increase in smishing
Last year, the NCSC also noticed an increase in "smishing". In contrast to conventional phishing via email, the fraud attempts are made via SMS or the SMS successor RCS, which is used by many messenger services. Last year, the brand names of letter and parcel delivery companies were mostly misused to lure the recipient to a phishing website, which then attempts to elicit credit card information.
Source: BACS
