Somewhere in the international swamp of low-rent cybercrime, somebody must recently have made a remarkable discovery: the Swiss speak Swiss German. This insight was apparently considered important enough to feed into the latest generation of AI-assisted phishing. Why send the usual clumsy German when a language model can make the whole thing feel local? Select Switzerland, request Swiss German, press generate, and presumably congratulate yourself on a sophisticated new form of social engineering. The result, unfortunately for the criminals and fortunately for everybody else, is less social engineering than accidental comedy.
I recently received one of these masterpieces, allegedly from Ledger, announcing a “Firmware 2.8.0 Wältwiiti Usrollig Für alli Ledger” and advising me that “S isch zwar nöd obligatorisch, aber mir empfehle d Aktualisierig dringend.” By that point, the greatest immediate danger was no longer the theft of my cryptocurrency but choking on my coffee. The strange thing is that the individual words are not even the main problem. Swiss people do, of course, speak Swiss German constantly, including in business. What the phishing geniuses have failed to understand is that spoken language and written language do not occupy the same social space. Written Swiss German is familiar and personal. It belongs in messages between friends, family, close colleagues and people who actually know each other. It is not how an international corporation normally announces a security update or explains cryptographic vulnerabilities to its customers.
That distinction matters because dialect implies a kind of proximity. A stranger addressing me in Swiss German does not automatically seem more trustworthy simply because he has managed to insert a few nöd, isch and alli. Quite the opposite. It feels like a man I have never met putting his arm around my shoulder and calling me by a childhood nickname. Ledger writing a formal security notice in dialect would be about as natural as the Swiss tax authorities opening a letter with: “Hoi, mir händ da no schnell dini Stüüre duregrechnet.” The sentence might be perfectly understandable and even linguistically plausible, but the context would make it absurd immediately.
The comedy becomes better still because there is no single Swiss German waiting conveniently in a dropdown menu. There are dialects, and some of them differ considerably. Zürich does not sound like Bern, Basel does not sound like eastern Switzerland, and the Valais has spent centuries ensuring that the rest of the country remains humble about its linguistic abilities. Even when dialect is written informally, people write it according to their own region, habits and instincts. There is no neat standard that an AI can spray over a phishing template and thereby transform a foreign scam into something convincingly Swiss. The result is synthetic Schwiizerdütsch, recognisable enough to identify what it is trying to be, but strange enough to make the sender sound like somebody who researched Switzerland during a delayed flight.
And after all this effort, the email still comes from an address resembling rockmeddywlair95+gmail.com. This is perhaps the most beautiful part of the entire operation. Artificial intelligence has been recruited to reproduce regional linguistic habits, fake technical details have been inserted, security terminology has been scattered across the page and the visual design has been polished to resemble a serious corporate message, yet nobody seems to have noticed that the sender address looks as though it was generated by a cat walking across a keyboard. It is an almost perfect summary of modern technological stupidity: vastly more sophisticated tools deployed without any corresponding increase in judgment.
The phishing industry has therefore discovered something useful about AI, although perhaps not what it intended. A language model can imitate the surface of a culture astonishingly well, but surface is not culture. Knowing that Swiss people speak Swiss German is information; knowing when they use it, how they write it, with whom and in what context requires understanding. The hackers have acquired the vocabulary without the instinct, which leaves them in the delightful position of spending more technology and more effort to make their scams less convincing than before. So I sincerely hope they continue. If artificial intelligence is going to improve cybercrime, the least it can do in the meantime is make the idiots considerably funnier.
So dear Hackers: fuck you all!
//Alex
alexreusch 