Info Guichet (Smishing) (2023-04-27)


Threat actors collecting personal information and credit card credential information


Threat actors are using a phishing campaign that mimics the appearance of the official Luxembourgish government website (

The attack begins with a fake SMS (in some cases also with a fake e-mail) asking to pay a fee of 49 euros.

The SMS text reads as follows:

Info Guichet : Vous avez une contravention impayée d'un montant de 49€ à ce jour. Consultez votre dossier d'infraction via :

from: +33 6 22 51 10 23

Please note the order of the words and the use of - instead of . in the link The original link is

When clicking on the link (“, the user is first presented a fake form which asks for a verification code.
Once that information is provided, the victim is redirected to a card form. After which the victim is redirected to another fake form. This form asks for personal information.
Finally, a page is shown that the payment was “successful” to make the user believe that he was indeed interacting with


phishing_landing_page phishing_wait phishing_form_credit_card phishing_form_pii phishing_form_completed


If you are uncertain about the authenticity of an email, do not hesitate to contact the entity that seems to have sent you the email using a safe communication manner, using the phone for example (no phone number from the untrusted email must be used in order to verify the authenticity).
If you are working for the Luxembourgish government or are using any of the GOVCERT.LU services, it is important to forward phishing emails to us (using Reporting an incident or the Outlook button). This will allow us to take down phishing websites and protect members of our constituency.

Report an incident

If you wish to report an incident anonymously, please complete the PGP encrypted reporting form.

> Report
> More Information