Latest Threat: Fake Ville de Luxembourg (VdL) "Relevé Annuel Communal" Phishing Scam

A new, highly sophisticated phishing campaign is targeting residents of Luxembourg by impersonating the Ville de Luxembourg (VdL) municipal administration and its Bureau de l'État Civil et du Registre de la Population.

The malicious email, carrying the subject "Avis d'émission : Relevé annuel et suivi de dossier — Administration Communale," claims that under national civil registry regulations (RNPP), the municipality is dispatching your mandatory "relevé annuel communal et certificat de résidence" (annual municipal statement and residence certificate).

The email asserts that your contact records have not been validated recently and creates artificial urgency by demanding an update within 10 business days via a button labeled "Vérifier mes coordonnées" to prevent communication delays.

How the Multi-Stage Scam Works:

• Deceptive Sender Address: While the display name appears as Bureau des Citoyens - Ville de Luxembourg, the actual sending address is [email protected], using a compromised German domain. Official communications from the capital always use verified domains such as @vdl.lu or @public.lu.
• Redirect Links & Domain Spoofing: The email links redirect through an external URL tracking system (mailing.fido.com.vc) before landing on a cloned portal hosted on vdl.lu-public.my.id. This domain mimics official VdL branding using an Indonesian top-level domain (.my.id).
• Personal Identity Harvesting: The landing page presents a convincing replica of the official Ville de Luxembourg portal, complete with municipal branding. It prompts the victim to enter their full legal name, date of birth, residential address, postal code, phone number, and email address.
• Postal Fee Trick: After collecting personal data, the website claims a small €1.45 fee is required for "frais d'acheminement sécurisé (POST Luxembourg)" (secure delivery fees) to lower suspicion and trick the victim into sharing payment details.
• Credit Card Theft: The victim is directed to a payment form requesting their full credit card number, expiration date, and CVV/CVC code.
• LuxTrust Credential Harvesting: Following the card submission, the site presents a fake LuxTrust authentication screen (requesting User ID and Password) to capture multi-factor authentication credentials in real time.

If you receive this notification, do not click any links and never enter your personal, banking, or LuxTrust credentials. Municipalities do not charge postal fees via third-party web forms to issue regular administrative records. Always access municipal services directly via official channels like vdl.lu or through your authenticated MyGuichet.lu account.