Financial fraudFake online banking
A fraudster creates a website that closely resembles the genuine online-banking portal of a Luxembourg bank. The victim may find the fraudulent site through a search engine, an advertisement, SMS, email or another link. The fake portal asks for login credentials and potentially authentication information.
The stolen information can then be used to access the victim's genuine banking account or facilitate fraudulent transactions. The Luxembourg Police has specifically reported cases involving fake online-banking portals that appeared genuine and advised customers to access online banking only through the bank's official app or official URL.
A particularly dangerous element is that the fraudulent website may appear identical to the genuine site.
Be extra cautious if the website was reached through a search advertisement: This is particularly relevant in Luxembourg because the Luxembourg Police has warned about fake banking portals appearing in search-engine results. Don't assume the first result in a search engine is the official banking website but use official bank app or manually enter a known official website url instead.
Concrete example
A customer wants to check his Luxembourg bank account and searches Google for the bank's online-banking service. He clicks on a result that appears legitimate and is taken to a cloned banking website. The page requests his username, password and authentication information. The victim enters the information and believes he has successfully logged in. The fraudster has, however, captured the credentials and may use them to access the genuine banking service and attempt unauthorised transactions.
Red flags,
stop if
- You receive an SMS, email, WhatsApp message or social-media message containing a link to “log in” to your bank.
- The web address is unfamiliar or slightly different from your bank's real address:
- You are being pressured to act immediately such as “Suspicious activity detected. Verify immediately.”
- Someone asks for your password, PIN or authentication code somewhere other than your bank's normal authentication process.
- You are asked to approve a transaction you did not initiate.