Phone and BankID Scams in Sweden: How They Work and How to Spot Them

Sweden’s scams rarely break into anything. They talk you into opening the door yourself. Here is how the calls, texts, QR codes and doorstep visits work, who they target, what to do in the first minutes, and when the bank has to pay you back.

When you need this

Someone phones claiming to be your bank, the police or a company and asks you to open BankID. A text says you owe a traffic fine, a parcel charge or customs duty and gives you a link. “Your child” writes from a new number and needs money for a bill today. Someone asks you to scan a QR code to “verify yourself”. Or it already happened, and you need to know what to do first.

One mechanism behind every scam

Fraud is the one major crime type still growing in Sweden. Brå, the National Council for Crime Prevention, counted 232,322 reported fraud offences in 2025, 1% more than the year before, while total reported crime fell 3%. Fraud now makes up 16% of all reported crime.

The reason is BankID. Swedish banking runs on this e-ID, and it is both a legal identity document and your signature. Fraudsters can’t break it, so they get you to use it for them. The banks’ industry body names four routes: phone calls (vishing), texts (smishing, Swedish bluff-sms), social media, and knocking on your door, which Polisen calls fysisk vishing.

Polisen describes callers posing as a relative, your bank, a company or an authority. They create stress, seem credible and often know your name, address or bank. Every variant ends the same way: you approve a login, scan a code, read out a number or hand over a card, and they act as you.

Who gets targeted: tourists vs new residents

Newcomers are the group most guides forget. Within weeks of registering you have a personnummer, a Swedish bank account, BankID and Swish, and from then on you face everything Swedes face (see the personnummer and BankID for visitors).

The five scams you will meet

1. The fake bank or police call. A caller says your card has been cloned, someone ordered things in your name, or there is a case against you. You are told to open BankID “to stop it” or to read out your card number. Polisen states it never calls to ask you to identify yourself with BankID or read out a card number. Your bank doesn’t either. The displayed number proves nothing: callers fake the name or number shown, often a real bank or authority. Polisen also never contacts anyone with an automated voice in English, so a recorded message about an “arrest warrant” is fake.

2. The parcel, customs or fine text. This is the scam a tourist is most likely to see. The text asks for a small fee by link. Tullverket, the Swedish Customs Service, never sends texts and never asks you to click a link or log in with BankID. Polisen does not send texts asking you to pay by link, and warned of a national wave of fake traffic-fine texts in April 2026. Real customs and VAT on a parcel exist, but the carrier calculates them, and Tullverket always tells you if it holds a parcel (see receiving packages in Sweden).

3. The “new number” family text. A message from “your child” says they have a new number, asks you to delete the old one, then needs money for an urgent bill. Polisen calls these SMS-barn texts. Call the person on the number you already have saved, or agree a control question with your family in advance.

4. The QR code. A text about an unpaid invoice gives a number to call. You are put through to “the bank”, which asks you to scan QR codes or install software. Polisen region Nord described exactly this in October 2025. The next section explains why it works.

5. The courier at the door. A call warns of a burglary wave in your area or a “virus” on your card, then someone arrives to collect cards, cash or valuables for safekeeping. Polisen never comes to anyone’s home to collect bank cards, credit cards or valuables. Polisen region Väst warned in July 2026 that these visits continue through the summer.

Why the QR code became the weapon

BankID changed its login flow to Säker start (secure start), with a deadline of 1 May 2024. If the service and BankID are on the same device, the service opens BankID automatically. If they are on different screens, you scan a QR code that keeps changing, which shows you are sitting at both. The old static QR code was phased out. The aim is that the person who starts a login is the person using the service.

That closed the old trick of asking for your personnummer and telling you to “open BankID”. So fraudsters now start the login on their own screen and get you to scan their code. If you approve, you have logged them in as you. The rule follows: only scan a BankID code on a site you opened yourself, and read the text in the BankID app before approving. It says what you are signing and for whom.

Good to know: older guides, written before 2024, may still describe the personnummer trick. The 2025–2026 police warnings describe QR scanning.

What police, banks and Tullverket never do

Two more rules from Polisen: never let anyone control your phone or computer remotely, and never use BankID because someone contacted you. You don’t have to be polite. Hang up, and have a phrase ready.

Since 2024 the phone networks have helped too. Operators block calls from abroad that display a spoofed Swedish fixed number (since 4 November 2024) or mobile number (since 3 March 2025). Since 1 August 2026 they must stop calls and texts that traffic data suggests are fraud. Some scams still get through, which is why the rules above matter (see phone numbers in Sweden).

Warning: Lending your account or BankID to someone, even “just to receive a payment”, is the money-mule role the banks see in fraud chains. Your account carries stolen money, and you carry the legal risk.

Scammed? What to do, in order

1. Call your bank first, on the number on your card or in its app, not one from the message. The bank can still stop payments; the police can’t. Block cards and Mobile BankID in the app or internet bank if you can.
2. Report to the police on 114 14, or +46 77 114 14 00 from a foreign phone. Call 112 if the crime is happening now. (see reporting a crime as a tourist).
3. Save everything: texts, the calling number, what was said, transfer details.
4. Get support from Brottsofferjouren, free, on 116 006.
5. If your identity was misused, ask a credit bureau such as UC about its free temporary block on credit checks for fraud victims.

A foreign card is blocked through your own bank, and the commercial Swedish “blocking services” act only for their own subscribers (see lost wallet or stolen cards). Forward the scam text to 7726 if you are on a Swedish SIM.

Will the bank pay you back?

Swedish law turns on one word: obehörig, unauthorised, meaning done without your consent. For an unauthorised transaction your bank must restore the account by the end of the next banking day after it learns of it, unless it has reason to suspect you authorised it.

In 2022 the Supreme Court decided a case where a man gave card-reader codes to a fraudster. It classed that as gross negligence, not particularly blameworthy, so his share was 12,000 kronor. The bank has to prove you understood and accepted the risk.

The gap is a payment you made yourself, such as a Swish to a “safe account” a fake bank officer gave you. That is not unauthorised under the law’s definition, and recovery then depends on the bank and, if you disagree, on ARN, the National Board for Consumer Disputes, whose decisions are recommendations most companies follow (see ARN consumer disputes). Cards issued abroad follow your issuer’s terms and your home rules.

A change is coming but is not here yet. The EU’s Payment Services Regulation, provisionally agreed in November 2025, would make banks refund the full amount when a fraudster posed as bank staff and you reported to the police and the bank. As of October 2026 it does not apply.

Practical information

FAQ

Will the police or my bank ever ask me to log in with BankID?

No. Polisen says it never calls to ask you to identify yourself with BankID or read out a card number, and your bank does not call to ask you to log in. Tullverket never asks you to log in with BankID either. If a caller asks, hang up and call your bank on a number you look up yourself.

Why do scammers ask me to scan a QR code?

Since May 2024 a BankID login started on another screen needs you to scan a changing QR code, which proves you sit at both devices. A fraudster who shows or sends you their code gets you to approve their login instead. Only scan a code on a site you opened yourself, and read the BankID text before approving.

I got a text about a parcel or customs fee. Is it real?

Treat it as fake. Tullverket never sends texts and never asks you to click a link or log in with BankID. Real customs charges are handled by the carrier, and you check them in the carrier’s own app or site, not through a link. If you typed in card details, call your bank and block the card.

What should I do if I’ve been scammed in Sweden?

Call your bank first, on its own number, to stop payments and block cards and BankID. Then report to the police on 114 14, or +46 77 114 14 00 from a foreign phone; call 112 if the crime is happening now. Save texts, numbers and transfer details. Brottsofferjouren gives free support on 116 006.

Does the bank pay back money lost to a BankID scam?

It depends. For an unauthorised transaction the bank must restore the account, and your share is at most 400 kronor, or 12,000 kronor if you were grossly negligent, which is how the Supreme Court classed handing codes to a fraudster. A payment you made yourself is not unauthorised, and refunds are then harder to win.

Can tourists be targeted by BankID scams?

Not directly: BankID needs a Swedish personnummer, so visitors don’t have one. Tourists do meet fake parcel, customs and police-fine texts, card phishing, and calls in English. Polisen never calls with an automated English voice. Newcomers who register and get BankID become targets for every variant, so learn the rules in your first week.

Related guides

• Pickpockets and tourist scams in Sweden — the street side: theft, taxis, fake rentals
• BankID for visitors — what BankID is and why tourists can’t get it
• Lost wallet or stolen cards — blocking cards in the right order
• Reporting a crime as a tourist — 114 14 and the case number your insurer wants
• Phone numbers in Sweden — spoofing, 078 numbers and the 2026 fraud-blocking duty

Facts verified 2026-10-14. Sources: Polismyndigheten, Tullverket, Sveriges riksdag (Lag 2010:751 om betaltjänster), Konsumenternas Bank- och finansbyrå, PTS, Brå, Svenska Bankföreningen, Brottsofferjouren, ARN and the European Parliament — full register in this topic’s source file. This is general information, not legal advice. Found something outdated? Tell us and we’ll fix it.