Fraud email claims to offer lucrative state bonus

An eagle-eyed reader alerted the RTL newsroom to the latest phishing attempt, involving an email that falsely claimed to come from the Luxembourgish government. The message used the address ‘etal.lu’ instead of the official ‘etat.lu’, a subtle but important detail.

The fraud email reads as follows:

New bonus available!
Dear colleagues,

Did you know that a new reward programme is available on MyRH? To encourage stability and performance within the Civil Service, we are delighted to announce the arrival of the attendance bonus. This bonus will be awarded to employees who demonstrate excellent attendance at work by minimising sick leave. To take advantage of this offer, log in to MyRH by clicking here. Follow the simple instructions and fill out the form to apply and receive the attendance bonus. To express your interest in this program and access detailed information on how it works, please visit the MyRH portal now! Need help? Visit MyRH to discover the services available, consult the FAQ or contact us directly via the online form.  THE GOVERNMENT OF THE GRAND DUCHY OF LUXEMBOURG Personnel Management and State Organization Center 10, avenue John F. Kennedy . L-1855 Luxembourg www.cgpo.public.lu . www.fonction-publique.public.lu . www.gouvernement.lu

Screenshot vun DNS.lu

A check of the email address on DNS.lu shows that the scammer put considerable effort into imitating government details. The ‘etal.lu’ domain is registered to the CERT Gouvernemental, but the address listed is Senningen Castle. The correct address should be 46 Rue du Château in Senningen, with the official homepage at www.govcert.lu.

It is not yet known if this scam attempt has only targeted civil servants or has been attempted on the general public.

RTL has reported the scam to the relevant authorities and will update this article with any further information once received.

Police reccomendations to avoid scams:

- One should always be wary of emails with strange requests or messages demanding urgent reactions, even if they originate from a safe sender.
- If someone is away from their office or PC for a prolonged time, they should remove the LuxTrust card from the reader to stop scammers from making unauthorised payments.
- Always check if an email is addressed to you or if it contains mistakes or poor translations.
- If the sender is unclear or if there is any doubt about the origin of the email, contact the organisation directly.
- Never click on suspicious links or attachments received via email.
-  If you think you may have inadvertently fallen victim to such a scam, have your device checked for RMM software as it is often not recognised by regular anti-virus programmes.
-  If you discover suspicious software on your PC, immediately change your password and LuxTrust PIN.
- Always check bank accounts and report any suspicious transactions to your bank.
- If you have fallen victim to a scam, immediately contact a police station and file a complaint.