How do I spot a fake job advert — and what does a real Swiss one look like?

Four checks that take a minute together

The first is the application link. Hover over it before you click and read the destination. In the normal case you will see either the employer's own domain or an applicant system you start to recognise after seeing two or three: myworkdayjobs.com, ohws.prospective.ch, rocken.jobs, umantis.com, greenhouse.io, smartrecruiters.com. In our index of open Swiss roles, Workday accounts for 8.9 per cent of destinations, Prospective for 7.2 per cent, Rocken for 6.1 per cent, Greenhouse for 3.2 per cent. None of these names is a guarantee — anyone can open an account — but none of them is free either, and all of them leave a trail.

The second check takes ten seconds: does the employer's name appear in the address the link points at? In 54.0 per cent of all adverts in our index it does, literally. Where it does not, that is not yet suspicious: a canton advertises under its administrative domain, a group under the parent name, an applicant system under its own. The case worth pausing on is the one where the domain has nothing to do with the company and belongs to no system anyone has heard of.

The third check is money. Of the adverts that carry a description at all, 0.6 per cent name a figure in francs. Swiss employers do not usually print the salary; it is settled in conversation, often against a collective agreement (Gesamtarbeitsvertrag) or a defined salary band. An advert whose opening line is about earnings has inverted the order of the entire market.

The fourth check is the channel. After first contact, an application should continue where it started: in the applicant system, by email to a company address, on the phone. Moving the conversation to a messenger — WhatsApp, Telegram, Element — is, in the BACS description, the step at which nearly every one of these schemes begins. Not a single advert in our index asks for that move.

What the Federal Office for Cyber Security reported in 2026

BACS keeps a standing page on fraudulent job offers, and it describes the basic shape: first contact via social networks, email or job platforms, communication then moved to a channel such as WhatsApp, and applicants lured with earnings promises that do not reflect the nature of the tasks — reviewing products, buying products, testing apps. After recruitment the applicant is sent to a website that looks legitimate but is not, and which supposedly processes the "salary payments" and "bonuses".

On 24 March 2026 the office set out how the scheme evolved. Wave one was the advance payment described above. Wave two was the task platform: earnings are credited only inside the platform, the supply of tasks dries up, new ones can be unlocked for a fee, and the real trouble starts at payout, when the operator asks for further fees for as long as the victim keeps paying.

On 9 June 2026 BACS published three reported cases from the recruitment process itself. A job seeker was invited to a phone interview and asked to confirm the slot through a Google calendar entry; the confirmation opened a convincing login window, and the credentials typed into it went straight to the attackers. A second person answered an advert from a supposed "Swiss social assistance" offering well-paid home-based work packing and forwarding parcels, was moved to WhatsApp, and was then asked for photographs of passport, identity card and driving licence. A third, an IT specialist, was approached on LinkedIn about a technical role, asked to download a private repository and solve a small programming task, and ended up installing an infostealer that reads crypto wallets, saved credentials and browser cookies.

The third case is worth reading twice if you work in tech: a take-home coding task is completely normal in that industry, which is exactly why it was chosen. In a related incident the approach came from a previously compromised, otherwise genuine-looking LinkedIn profile — the credibility was borrowed rather than built.

Why "check the commercial register" is no longer enough

The standard advice is to look the company up in the commercial register. It is not wrong, but the newest variant BACS describes is built to walk straight past it. The scammers look for firms that are entered in the register and have no website of their own, and then build one for them. The details on the new site match the register because they were taken from it.

According to BACS such sites can be recognised partly by their domain having been registered only days earlier. Logistics firms are hit particularly often, usually with offers of flexible work from home. The operation is multilingual: every language region of Switzerland is affected, including a purported firm in Ticino.

Two further details from that report are worth keeping. The fake sites gave the "jobs and careers" area unusual prominence, and the link led to a password-protected page — applicants were given the password at the start so that outsiders and the authorities could not open it. And these adverts were placed on legitimate job platforms; BACS knows of cases where they appeared in printed newspapers, which it had never observed before. Where an advert is published proves nothing.

So the register answers whether the company exists. It does not answer whether this advert came from that company. The website the firm has been running for years answers that, and so does a phone call to the number printed on it.

How old is the domain behind a real advert?

The "registered days ago" signal is only useful if you know what normal looks like, so we measured it. For every .com domain behind a live advert in our index we asked the registry's public lookup service when it was registered. The median domain was registered in 2003 and the oldest in 1986; a quarter date from 1997 or earlier. Only 4.1 per cent were registered in 2025 or later, and because those domains carry few adverts each, they account for 0.9 per cent of the adverts pointing at a .com address. In other words: a domain less than a year old is unusual behind a Swiss advert, but not unheard of — a young company has a young domain.

For .ch domains the same lookup exists and returned a registration date for every one of the few dozen we queried before the registry declined further bulk requests. That limit does not affect you: checking one domain before one application is a single query. The public lookup lives at rdap.nic.ch for .ch and at rdap.verisign.com for .com, and each returns the registration date wherever the registry publishes one — a handful of entries carry no date at all.

Treat the result as one input among four, not as a verdict. A brand-new domain plus an unnamed employer plus a messenger plus a promise of pay is a pattern. A brand-new domain on its own is a start-up.

What Swiss law requires of an advertiser — and in which languages it exists

For commercial intermediaries, a job advert is not a free text. Article 7 paragraph 1 of the Employment Services Act (Arbeitsvermittlungsgesetz, AVG) requires an agency publicly advertising vacancies to state its name and exact address, and states that adverts must correspond to the actual facts. Article 18 paragraph 1 imposes the same duty on staff-leasing firms and adds one: the advert must state clearly that the worker is being employed for staff leasing.

That duty binds agencies and leasing firms, not an employer advertising its own vacancy — a distinction almost every guide omits. It still gives you a standard: an advert that names no company, gives no address and offers nobody to call is visibly below the level the law sets for the professionals in this market.

Operating without the required licence is punishable under Article 39 paragraph 1 AVG with a fine of up to CHF 100,000, and prosecution is a cantonal matter. Whether a given firm holds that licence is public: SECO and the cantons run a register of licensed placement and staff-leasing businesses, which according to SECO currently lists more than seven thousand firms.

One point specific to reading this in English. The AVG and its ordinances are published on Fedlex in German, French and Italian only — there is no English version to check, so any English rendering, including this one, is a translation. The Criminal Code does have an English version, and it carries the standing note that English is not an official language of the Confederation and that the translation has no legal force.

Money up front: the line the law draws

A placement agency may charge a job seeker a registration fee and a placement commission — but Article 9 paragraph 2 AVG states that the commission is owed only once the placement has led to an employment contract being concluded. The maximum amounts are set not in the act but in the fee ordinance made under it, and they are low.

In staff leasing the line is stricter still. Under Article 19 paragraph 5 letter a AVG, agreements requiring the worker to pay fees, make advance financial contributions or accept deductions from pay are void — they have no effect from the outset. Article 39 paragraph 2 letter d makes demanding such fees or advance payments an offence.

This lets you answer the most common question without judging the individual offer: a payment before any contract exists — for a permit, an insurance policy, training, equipment, or to "unlock" anything — has no place in the process Swiss law lays down for job placement. BACS puts the same rule as advice: do not respond to job offers that require advance payment, and be sceptical of payments you are asked to make while doing the job.

This answer explains the rule; it is not legal advice on your own situation. The cantonal labour market authority that issues these licences, or a legal advice service, is the place for that.

What a real Swiss advert says about pay, place and home office

A fake advert almost always makes the same three promises: a lot of money, from home, with no requirements. All three can be measured against the live market, and all three are rare in it.

Pay: 0.6 per cent of adverts carrying a description name a figure in francs, and the share is similar whatever language the advert is written in — 0.4 per cent in German, 0.5 per cent in English, 0.5 per cent in French.

Place: 97.9 per cent name a municipality, city or region. Only 2.1 per cent say nothing more specific than "Switzerland". An advert with no workplace is the exception here, and "location-independent" is not a location.

Home office: 2.7 per cent of adverts with a description mention home office or remote work at all, and 0.2 per cent describe themselves as fully location-independent. English-language adverts mention it most often, at 4.7 per cent, which is worth knowing if English adverts are most of what you read — it is the highest share in the market and still one advert in twenty.

If you are new to Switzerland, one more convention helps. A Swiss application dossier normally contains a CV, a letter, diplomas and Arbeitszeugnisse (the written employer references that are standard here). It does not contain a passport copy. Identity documents belong to personnel administration after an offer, which is exactly why the parcel-forwarding scheme asked for them during the application.

Why "forwarding payments" is not a job

Some fake offers are not looking for victims but for instruments. The parcel case BACS describes is the model: the work consists of receiving parcels and forwarding them to addresses mostly abroad, so that the real recipient is hidden. In parallel, the identity documents collected during the "application" are used to order goods in the victim's name with stolen card details, and shown to online shops that ask for proof.

The same construction exists with money instead of goods: provide an account, forward incoming payments, keep a commission. Doing that means carrying out an act designed to frustrate the tracing of the origin of assets — which is how Article 305bis of the Criminal Code describes money laundering, punishable by a custodial sentence of up to three years or a monetary penalty.

The fraud itself falls under Article 146, with a custodial sentence of up to five years or a monetary penalty, and six months to ten years where the offender acts commercially. That is also why so much effort goes into recruiting the middle layer: the scheme needs somebody with a Swiss address and a Swiss account standing between the perpetrators and the act.

For judging an advert, one question is enough: is the core of the task moving money or goods onward? Then it is not a side job, it is a role in somebody else's offence.

Before you upload documents — and afterwards

BACS gives an order of operations that helps more in practice than any list of tells. Do not give up your data too early: account details and copies of identity documents are relevant only after an offer. Never make advance payments, and never make your account or your address available for somebody else's transfers of money or goods. Stop as soon as your virus scanner or your browser warns you. Do not click links or run commands whose origin you do not know.

Add one check that works for every unsolicited approach: confirm that the company the advert claims to come from actually has vacancies, and use the number on its official website rather than the one in the message. If the approach comes through an intermediary, the SECO register tells you whether that firm holds a licence at all — though not whether the person writing to you speaks for it.

If something has already happened there are two separate routes, and both are worth taking. Where you have suffered financial loss, BACS recommends filing a criminal complaint with your local police; Suisse ePolice will find the nearest station. Independently of that, BACS accepts reports through its online form even where nothing was lost — those reports are what the warnings quoted here are made of.

If you have already sent copies of identity documents, the loss is not the document but its reuse. In the parcel case the copies were the proof shown to online shops. That is why reporting still matters when no money has moved.

What these numbers cannot do

Every share here describes adverts that are live in our own index — a set an advert enters only after a check. It does not describe the whole Swiss market, and certainly not the offers circulating in messages, groups and platforms nobody indexes. "No advert leads to a messenger" means: none in what is published here.

Two limits belong with that. The statements about pay, place and home office rest on the title and a short description rather than the full advert text, so those shares are floors rather than exact rates. And the destination classification maps addresses against a fixed list of known applicant systems; a system we do not know counts as an employer domain.

The most important limit is the last one. None of this proves that an individual advert is genuine. The figures say what the normal case looks like. Knowing the normal case is what makes the deviation visible — and it means you never have to recognise the fake itself.