A call from a withheld number, a suspicious transaction reported, then QR codes to approve in the app: in the case reported by RTL, every step was presented as a form of protection. Yet it contributed to the theft of 10 000 euros. The scenario shows how a phone scam can rely on legitimate digital tools; none of the sources consulted report a hack of LuxTrust.
Urgency turns the victim into an executor
RTL reports that Marc, a name changed by the newsroom, was driving when a caller introduced himself as a LuxTrust employee. He told him about a suspicious transfer of 750 euros to Romania and offered to block it. Contact continued for two days: the fake adviser explained that Marc had to follow a procedure to cancel the transaction and block his bank cards.
The account describes several actions, each presented as a security measure. Marc shared passwords and personal data, then scanned QR codes received by email and confirmed transactions in his LuxTrust app. He also filled in a form and handed his cards to a man who came to collect them. The next day, his bank told him that 5 000 euros had been debited from each of his two cards, 10 000 euros in total. He contacted his bank and filed a complaint; at the time of the report, a refund was not guaranteed.
The mechanism relies less on technical prowess than on a convincing performance. The caller announces a threat, presents himself as the person who can neutralise it and provides the steps to follow. The pressure leaves less time to check; repeated calls sustain the impression that a case is under way. A familiar QR code or app does not, in itself, make a request legitimate: what matters is the action you are being asked to confirm.
When data makes a fake call convincing
LuxTrust describes vishing as a form of phishing carried out by phone: the scammer pretends to represent a trusted organisation to obtain sensitive information or persuade the person to act. The company cites urgency, fear and fabricated security alerts among the common tactics. It also warns against phishing by email or SMS, and quishing, which uses a QR code to lead to a fake website or trigger a malicious action.
These techniques can follow one another. Someone who has already replied to a message or entered data on a fraudulent website may then receive a call that seems connected to the incident. RTL explains that personal information obtained through phishing can make the caller’s story more convincing. This apparent consistency does not, however, confirm the caller’s identity: accurate details about someone do not prove that the person contacting them represents the organisation they name.
In the case recounted by RTL, the collection of the cards from Marc’s home is another warning sign to remember. LuxTrust says it never sends anyone to collect bank cards or authentication devices. The company also states that it does not ask for passwords, one-time codes or PINs by phone, email or SMS. These principles provide a practical way to check a call that claims to be a security intervention.
Stop the procedure and take back control
The first precaution is not to continue with a procedure dictated during an unexpected call. Do not share a password, PIN or security code, and do not approve a transaction in an app simply because the caller describes it as necessary to block fraud. Nor should you scan a QR code received in this context without checking where it came from and where it leads.
If you are still unsure, end the exchange and contact the organisation yourself using contact details found on its website or in its official documents. This avoids relying on the number, link or email address provided by the person who contacted you. The recommendation from AXA reported by RTL is along the same lines: if you are unsure about a message, contact the company directly rather than following a suspicious link.
If you have already entered or shared information, contact your bank immediately to report the situation and have transactions or attempted access checked. If money has been debited, the bank can investigate whether a transaction can still be stopped or whether recovery is possible, though this does not guarantee a refund. Filing a complaint with the police also allows you to report what happened and support an investigation.
RTL reports that 66 fraud cases were reported to the police in October, including cases involving fake calls, emails and SMS messages. This figure concerns the reports mentioned in its article; by itself, it does not describe all attempts or how they have changed over a longer period. For readers, the practical rule is immediate: someone claiming to protect an account should not ask you to hand over your access credentials, blindly approve a transaction or entrust your cards to a third party.
References
An incoming call on a phone. Illustrative photo.
