In early July, a number of people in Luxembourg fell victim to a scam consisting of a fraudulent website posing as the Banque Internationale à Luxembourg (BIL). RTL spoke to some of them.

Among the victims is Alice Pauly, who clicked on the link to the scam site on 5 July and lost €6,500 almost immediately. She, and several others who were duped by the site posing as BIL, say they feel the bank has left them in the lurch and are now banding together to try and get their money back.

Pauly had been trying to handle a few online payments that Sunday. But the website she found via a search engine was a scam, despite looking exactly identical to my bank's website," she told RTL.

But it later transpired the website was a fraud. By Monday, as Pauly recalls, a BIL employee even admitted that the page looked eerily authentic, remarking: "Oh gosh that is really well done!"

Unaware of the scam, Pauly entered her LuxTrust information. She noticed the site took a suspiciously long time to load, then came the realisation: "I was left with just four euros in my account. It knocked the breath out of me. I scrolled down and saw that 6,500 euros had been transferred from my account to a French bank account under a name I believe to be African."

Nearly a month on, Pauly still hasn't recovered the stolen money. She believes her bank shares some of the blame, accusing BIL of failing to act quickly after she reported the incident. Despite blocking her account and visiting a branch in person– after being unable to get through on the hotline – Pauly says the bank simply logged her case and advised her to file a police report. Fortunately, the police were reportedly helpful and have launched a money laundering investigation.
 
Pauly later learned that, in her view, BIL should have taken immediate action when she first reported the incident, without making her responsible for initiating the process. She feels the bank made a serious error by shifting the burden to her.

While BIL is understandably unhappy that fraudsters are targeting its customers, the bank’s Head of Cybersecurity, Nicolas Remarck, explained that responsibility isn't always clear-cut. When a transaction is digitally signed, which is a strong form of identity verification, the customer has to bear some of the liability. Each case must be assessed legally on its own merits.

Remarck declined to disclose how many customers were affected, but said around 75% of victims were able to recover their funds with help from the cybersecurity team. Pauly, unfortunately, was among the 25% for whom the losses were irreversible.

Another young man, also a BIL customer, has been fighting since December to recover €12,000 lost to a similar scam. Like Pauly, he entered his credentials voluntarily.

Roughly ten victims have now formed a WhatsApp group for support, Pauly shared. They hope to bring others into the fold – such as lawyers, police representatives, and experts from the financial crime or anti-money laundering divisions – to see what collective steps they can take.

They plan to meet in person in mid or late August to explore their legal options. One idea on the table is to consult a lawyer about launching a class action suit. Their ultimate goal: to recover the money that was stolen from them.

In the meantime, police continue to advise extreme caution when entering personal data online. The golden rule: always double-check that the site is legitimate.