A new phishing attack is currently targeting members of the CMCM (Caisse Médico-Complémentaire Mutualiste) in Luxembourg. The scam uses urgent wording claiming that your membership card is expiring and must be renewed immediately to continue enjoying mutual health benefits.
The malicious email, sent with the subject line "concernant votre carte CMCM," attempts to look authentic by copying the official CMCM logo, health mutuelle branding, and the organization's real physical address in Luxembourg-Hollerich. It directs victims to click a button labeled "Demander le renouvellement".
How the Multi-Stage Scam Works:
- Unauthorized Sender Address: Although displaying "CMCM lu GOV," the actual sending address is
[email protected]via Amazon SES, completely disconnected from the official mutual health fund domain. - Deceptive Redirects & Spoofed URLs: The email link initially routes through an external tracking domain (
cartemembre.lavitaèbella.eu) before landing on a counterfeit portal hosted onmycmcm.lu-cartemembre.com. The scammers use a deceptive subdomain to make the link appear as though it belongs tomycmcm.lu. - Fake Administrative Fee: Upon accessing the portal, a modal dialog informs the user that a mandatory "annual renewal" has been required since September 14, 2026, and charges a fraudulent processing fee of 3,63 €. The CMCM does not solicit small online fees via email links to issue or renew member cards.
- Personal Identity Harvesting (Step 1/3): Victims are instructed to fill out an identity form requesting full names, birth dates, home addresses, phone numbers, and email addresses.
- Financial Data Theft (Step 2/3): The portal proceeds to a payment screen demanding complete credit card details, including the cardholder name, 16-digit card number, expiration date, and CVV code under the guise of settling the 3,63 € fee.
- LuxTrust Credential Harvesting (Step 3/3): In the final stage, the malicious site displays a cloned LuxTrust Mobile login interface, prompting users to surrender their LuxTrust User ID and password. This allows cybercriminals to attempt unauthorized account takeovers and bypass banking two-factor authentication in real time.
If you receive an unsolicited email asking to renew your CMCM membership card, do not click any links and never provide personal, banking, or LuxTrust information. Delete the email immediately. To manage your mutual coverage safely, visit the official CMCM portal directly at cmcm.lu or log in via the official CMCM app.