Caller ID spoofing: Luxembourg's ongoing battle with scammers

Particularly popular among organised crime groups, caller ID spoofing allows criminals to make calls using phone numbers that are not actually theirs with a country code of their choice. Through spoofing, fraudsters are able to impersonate others with much more credibility.

Cases skyrocketed on a global scale in recent years. In Luxembourg caller ID spoofing proved successful as well, with multiple reported cases, one particular Luxembourgish man reported losing €30,000 to a spoofing scam.

The European Union Agency for Law Enforcement (Europol) recently underlined a lack of a coordinated EU-wide strategy in fighting caller ID spoofing. In their survey of 23 European law enforcement agencies, Europol mentions multiple challenges keeping law enforcement from effectively tackling scams involving spoofed numbers.

Among the issues cited: poor communication between law enforcement and operators, gaps in regulation, and difficulties in cross‑border cooperation.

This begs the question, how well are Luxembourgish consumers protected?

Detecting fraudulent calls

Authorities in Luxembourg have set measures in place when it comes to detecting spoofed calls, to varying degrees of success.

The regulatory authority for telecommunications in the Grand Duchy is the Luxembourg Regulatory Institute (ILR). In 2024, the ILR introduced a regulation allowing operators to block calls that appear to use Luxembourgish landline numbers originating from abroad.

While this was a crucial step in protecting consumers and has significantly reduced the number of spoofed landline calls. It has also prompted scammers to shift their focus to mobile numbers.

Verifying mobile numbers is more complex. While national landline numbers cannot legitimately be used to make calls from outside Luxembourg, many residents use Luxembourgish mobile numbers both domestically and abroad. To address this, operators have implemented "homerouting" technology, which routes caller traffic through the home network even when subscribers are abroad. This allows operators to verify whether calls using Luxembourgish mobile numbers are genuine.

The system is not foolproof. As an ILR spokesperson explained: "The Luxembourg mobile operators have already implemented this and are able to recognize whether calls are legitimate. However, additional measures still need to be put in place to ensure that everything is fully covered and always works".

Despite these limitations, the ILR confirmed that spoofing cases involving Luxembourgish numbers, both mobile and landline, have declined sharply since the measures were introduced. Yet these protections stop at the border: detecting and blocking spoofed foreign numbers remains a major challenge without proper cross-border collaboration.

Investigative difficulties

This lack of universal regulatory framework and technical limitations also affects police investigations, making it difficult for law enforcement to find who's really behind a spoofed phone number.

Catherine Weber, Deputy Director of Communications for the Luxembourg Police, highlights the investigative difficulties posed by caller ID spoofing: "There are a series of procedures that of course must be followed when one wants to identify the holder of a telephone number", procedures which, she notes, make investigations more complex.

Furthermore, spoofed calls are mostly done using Voice over Internet Protocol (VoIP) services, making it even harder to trace who's really behind them.

Another factor Weber highlights is the variation in Know Your Customer (KYC) protocols. While some countries require customers to verify their identity using official identification, others do not, making it possible to use certain services without identity verification.

She also emphasises that the police remain in continuous contact with both Luxembourgish and foreign operators. Their proactive approach and awareness-raising efforts with these operators are being further strengthened.

Despite the investigative challenges, the police stress that, alongside their investigative work, they are also committed to educating the general public about ongoing scams and how to avoid them, through communication campaigns and official warnings.