A 22-year-old Luxembourg national was arrested in Spain and taken into custody in Luxembourg on Friday, the public prosecutor’s office has announced. He is suspected of being one of the organisers behind “Luxtrust fraud"-type scams and large-scale phishing attacks.
The Luxembourg native, born in 2004, was the subject of a European arrest warrant. Arrested in Spain at the end of February, he was handed over to Luxembourg’s judicial authorities on Thursday evening. He was brought before an examining magistrate in Luxembourg on Friday, 27 March, who ordered his immediate remand in custody.
According to a press release issued by the public prosecutor’s office on Saturday, the alleged scammer is suspected of being “one of the main perpetrators and organisers of ‘Luxtrust fraud'-type scams and phishing attacks targeting, in particular, spoofed MyGuichet and Luxtrust websites.”
The young man allegedly played a “leading role in the organisation of these scams,” notably “by coordinating the network’s activity and recruiting other participants to carry out the various tasks.” He is also suspected of money laundering involving funds derived from the scams.
The public prosecutor’s office said the acts in question are liable to be classified as fraud, computer fraud, theft, money laundering, and participation in a criminal organisation or criminal association, respectively.
The arrest follows a large-scale investigation conducted by the Criminal Police Service under the direction of Luxembourg’s judicial authorities, with operational support from the European Network of Fugitive Active Search Teams (ENFAST), in particular the Luxembourg and Spanish FAST teams.
While the full extent of the acts he is accused of “remains to be determined,” the public prosecutor’s office stated that during 2024 and 2025, “more than 700 complaints related to Luxtrust fraud-type scams were registered with the police, for a total loss exceeding €10 million.”
The investigation is ongoing to establish the full scope of the criminal activity, identify all potential perpetrators and accomplices, and trace the financial flows generated.
The Luxembourg Public Prosecutor’s Office reminds the public that no banking institution, financial service provider, or Luxtrust ever asks clients to share security data, passwords, or confidential codes, nor to validate transactions following suspicious calls, messages, or links. Additionally, these institutions do not show up at clients’ homes to collect bank cards or other valuable items.
