Marc, (name changed at his request) was driving when he received a call from a withheld number. On answering, the caller introduced himself as a representative from LuxTrust, claiming there was a suspicious transfer of €750 to Romania being made from Marc's bank account.
The supposed security team had contacted him, the caller explained, to help block the transaction.
Worried about his finances, Marc remained in contact with the fraudsters over the next two days, receiving multiple calls. The scammers told him he needed to follow a procedure to cancel the suspicious transfer and block his bank cards.
During these conversations, Marc was asked to provide passwords and various personal details. He received emails with QR codes, which he was instructed to scan and confirm via his LuxTrust app.
The fake LuxTrust employee later informed Marc that someone would come by to collect his bank and Visa cards. He was told by phone and email to place the cards in an envelope and fill out a form. Indeed, shortly after, a man arrived and took the cards.
The following day, Marc received another call from the same person, who claimed that the cards still had not been blocked and insisted Marc follow further instructions.
Later that day, Marc received a call from his actual bank, this time, not a scam. The bank informed him that €5,000 had been withdrawn from each of his two cards, resulting in a total loss of €10,000.
Marc went to his bank immediately and filed a police report. Despite his swift reaction, it is not yet clear whether he will recover the stolen funds.
Marc's case is far from isolated.
Police recorded sixty-six cases of fraud in October alone, which involved fake phone calls, emails, and text messages. After a relatively quiet summer, these types of scams are once again on the rise in Luxembourg.
Criminals often impersonate well-known companies or organisations, including LuxTrust and Wero.
Insurance company AXA also warned its clients this month about scam messages sent in the insurer's name. AXA advised customers not to click on suspicious links and to contact the company directly if they are unsure whether a message is genuine.
According to police, many scams begin with a cyberattack targeting a company, online platform, or organisation that stores users’ personal data.
Such attacks can result in large quantities of personal information - names, phone numbers, email and home addresses, and sometimes even bank account details - falling into the wrong hands. These details are then traded among criminals and used to carry out various types of fraud.
For phone scams, criminals often buy thousands of phone numbers to reach potential victims. One common method is to send mass text messages containing links to fake websites, aiming to trick people into entering their personal information.
Once the scammers have these details, they may call the victim directly. Because the fraudsters already know several personal facts, their calls seem more plausible.
Sometimes the call comes days after the first contact, by which point the victim may have forgotten clicking a suspicious link.
The scammers typically pose as employees of a bank or another trusted organisation, claiming that the victim's data was compromised after clicking the link.
In the hope of resolving the issue, victims may end up giving away even more personal or financial information, and ultimately giving the criminals access to their money.
It is becoming increasingly difficult to prevent personal data, especially phone numbers and email addresses, from falling into the wrong hands, as people regularly share such details when signing up for online services or shopping on the internet.
Nonetheless, there are steps to reduce risk. Police recommend ordering as a guest when shopping online, where possible, to avoid creating accounts and storing more personal information than necessary.
Above all, police stress a basic rule: never click on a suspicious link without first checking who sent it, and never share passwords, PINs, or security codes over the phone.
Police also emphasise that banks will never ask clients to provide PINs or security codes by phone.
If you have clicked on a suspicious link and entered personal information, contact your bank immediately. Explain what happened and ask them to check for suspicious transactions or attempted account access.
Remain vigilant in the days that follow, as further scam calls, emails, or messages may arrive, sometimes with fraudsters impersonating your bank or other trusted organisations.
Do not respond to such contacts. If you are unsure whether a call or message is genuine, contact the organisation directly using their official contact details.
If you have already lost money as a result of fraud, contact your bank immediately. Depending on the situation, it may still be possible to stop a transaction or recover lost funds.
You should also file a report with the police, who can investigate and attempt to identify those responsible.
