A new, highly opportunistic phishing campaign is actively targeting users in Luxembourg. Attackers are exploiting the transition from Payconiq to the European payment system Wero to orchestrate an aggressive credential and payment card harvesting scheme.
The deceptive email carries the subject line "Payconiq devient Wero au Luxembourg" and claims that Payconiq terminated its services in the country on September 30, 2026. Under the pretext of maintaining uninterrupted payment services and regulatory compliance, the message demands that users immediately "renew their digital certificate" within three days via a call-to-action button labeled "Renouveler mon certificat". To manufacture urgency, the attackers threaten account deactivation and a fake €10 inactivity penalty if the recipient fails to comply.
How the Multi-Stage Scam Works:
- Unauthorized Sender Infrastructure: While the display name impersonates
Wero Luxembourg, the email originates from[email protected]via Brevo/Sendinblue relay infrastructure (pp.d.sender-sib.com), failing domain alignment with official payment providers. - Deceptive Domain Architecture: The email redirect funnel sends users to a counterfeit domain hosted at
wero.gestion-compte.com, engineered to impersonate Wero's brand design, legal disclosures, and European Payment Initiative (EPI) references. - Mandatory Update Hook: The landing screen presents a fake "Mise à jour requise" notice claiming updates are mandatory under PSD2 ("DSP2") banking security requirements to entice victims forward.
- Personal Information Harvesting (Step 1): The malicious flow prompts victims to complete a full profile form collecting first name, last name, email address, physical postal address, postal code, and city.
- Payment Card Theft (Step 2): Victims are redirected to a "Vérification carte" page that requests the full cardholder name, 16-digit debit/credit card number, expiration date, and CVV code under the guise of securing future instant transactions.
- LuxTrust Credential Harvesting (Step 3): In the final step, the site mimics a "Connexion LuxTrust" interface, prompting users to surrender their LuxTrust User ID / Identifiant and password to allegedly link their account to their bank. Once submitted, a simulated loader screen displays "Nous finalisons la liaison entre Wero et LuxTrust" before redirecting to an activation confirmation.
If you receive this notification, do not click any links and never enter your personal information, credit card numbers, or LuxTrust credentials. Neither Wero, Payconiq, nor Luxembourg banks will ever ask you to validate or update payment certificates via third-party web forms or threaten inactivity fees via email. Always manage your payment applications directly through your official banking portal or the verified app.