Cybersecurity
Fake LuxTrust and police emails in Luxembourg: how to spot the scam before you click
A convincing phishing message uses real names, a real LuxTrust phone number and a fake redirect. The dangerous part is not the logo, but the link behind it.
A phishing email reported by RTL shows how far scam messages in Luxembourg have moved beyond clumsy spelling and obvious fake logos. The message claims that someone in Portugal logged into the victim’s LuxTrust Mobile account in the early hours of 15 May, and that a transaction is still being “verified”.
The structure is designed to feel official. It refers to LuxTrust, the Police Grand-Ducale and government obligations, and it tells the recipient that LuxTrust has informed the police and that an investigation has been opened. That institutional framing is the hook: it makes the message feel urgent before the reader has time to inspect the details.
The trick: real-looking details with a fake action
RTL notes that the email displays the real LuxTrust assistance phone number. But the clickable phone link underneath redirects to a French number with the 0033 prefix. That is the critical difference between what the message shows and what it actually makes the user do.
The email also uses a police-looking contact address ending in @police-public.lu. That is close enough to look familiar at speed, but it differs from legitimate Luxembourg police domains such as @police.public.lu and @police.etat.lu. The sender address itself also does not match Luxembourg state-domain patterns and appears to route through Belgium rather than Luxembourg.
What to do if you receive it
Do not click the phone number, link or email address inside the message. If you are worried about your LuxTrust account, open the official LuxTrust website or app yourself, or manually type the known customer-service number from an official source. If money or identity access may be involved, contact your bank through its official app or card number.
The broader rule is simple: in Luxembourg, a message can use real institution names and still be fake. The safest check is not whether the email mentions LuxTrust or the police, but whether the domain, link target and contact route are exactly official.
Frequently asked
- Is the LuxTrust phone number shown in the email enough to trust it?
- No. RTL reports that the displayed number can be real while the clickable link redirects somewhere else.
- What should I check first?
- Check the actual link target, the sender domain and whether the contact route matches official LuxTrust or police channels.
Sources
Around Politics
A look at recent reporting on politics from the Étude newsroom.
More in Politics
Trending at Étude
Labour law Cross-border unemployment in Luxembourg: what could change for frontaliers
Public safety Pickpockets in Luxembourg City: why police are warning tram users now
Eurovision Luxembourg misses the Eurovision 2026 final: what Eva Marija’s exit means
Mobility ING Night Marathon Luxembourg 2026: what runners and residents need to know