Secure a compromised LuxID Account
If you notice unfamiliar activity on your LuxID Account, someone else might be using it without your permission. Follow the steps below to help spot suspicious activity, get back into your account, and make it more secure.
Your LuxID Account is tied to your email address, which is also how you reset your password and receive security alerts. If someone else controls that email account, they can undo anything you change here. Before you secure your LuxID Account, make sure the email account itself is safe: change its password and turn on 2-Step Verification with your email provider. If you can no longer get into your email, contact your email provider first. (If your email is a POST webmail address, note it has its own password, separate from your LuxID password - resetting one does not change the other.)
Step 1: sign in to your LuxID Account
If you can still sign in, go to your LuxID Account (opens in a new tab) and proceed to Step 2.
If you can't sign in
Go to the LuxID password reset page (opens in a new tab) and follow the instructions. For tips, see Tips to complete account recovery steps.
Use the password reset page if:
- Someone changed your account password.
- Someone changed your security settings.
- You cannot sign in for another reason.
Step 2: review activity and help secure your account
Review your account security settings
- Go to your LuxID Account (opens in a new tab).
- Go to Security.
- Review recent security activity for anything suspicious.
- If you find activity that was not you: Change your password immediately and follow the on-screen instructions to secure your account.
- If you recognise all the activity: Continue to review your other security settings.
Review your connected applications
- Go to your LuxID Account (opens in a new tab).
- Go to Applications.
- Check for any applications you do not recognise and revoke access to any that look suspicious.
Step 3: take additional security steps
Turn on 2-Step Verification
2-Step Verification helps keep hackers out of your account. With 2-Step Verification, you sign in with:
- Something you know (your password)
- Something you have (your phone or a security key)
That way, if your password is stolen, your account is still secure. You can enable 2-Step Verification at LuxID Account (opens in a new tab) > Security.
Change your password
If you have not already done so, change your password immediately. Choose a strong, unique password that you have not used with any other account.
After changing your password, also change the password on any other accounts where you used the same password - especially the email account linked to your LuxID Account. LuxID sends a notification to that email address whenever changes are made to your account, so if an attacker still has access to your inbox, they could read those notifications and anticipate your next steps. Securing your email first cuts off that visibility.
Remove harmful software
If you think your account has suspicious activity, you might need to remove harmful software from your devices. Install and run trusted anti-virus software to improve your security.
You can also reset your device to factory settings and reinstall the operating system.
Contact LuxID support
If you need further assistance securing your account, contact LuxID support.
Find out if your LuxID Account has been compromised
If you notice any of these signs, someone else may be using your LuxID Account:
- Unfamiliar changes to your security settings (password, phone number, or 2-Step Verification settings)
- Applications connected to your account that you do not recognise
- Notification emails from LuxID about sign-ins or changes you did not make
If you think someone else is signed in to your LuxID Account, change your password immediately at LuxID Account (opens in a new tab) > Security. Then review and update passwords for:
- Any accounts where you use the same password as your LuxID Account
- Any accounts that use your LuxID email address as their login
Suspicious account activity
Unfamiliar changes to critical security settings
Check and correct immediately if you see unfamiliar changes to:
- Your password
- Your phone number
- Your 2-Step Verification settings
- Applications with access to your account (at LuxID Account (opens in a new tab) > Applications)
Unusual activity notifications
LuxID will inform you of unusual activity through email notifications sent from notification@msg.luxid.lu. If you receive a notification about activity you do not recognise, take immediate action to secure your account.
If LuxID blocks your account
Sometimes the risk is serious enough that we do not leave securing the account up to you. If LuxID determines that someone other than you has accessed your account, we may block it to stop a malicious person from taking it over completely. This is most likely when your account has no 2-Step Verification, because a stolen password is then enough for an attacker to gain full control.
Only LuxID can block or unblock an account - you cannot remove the block yourself. The next time you try to sign in, you will see that your account is blocked.
To get unblocked, contact LuxID support; we will verify your identity before restoring access. Our team will then unblock your account and help you reset your password and turn on 2-Step Verification so it is harder for this to happen again.
Turning on 2-Step Verification is the best way to avoid this situation. Even if someone learns your password, they cannot sign in - or take over your account - without your second factor.
For your security, LuxID will never ask for your password or verification codes over email, phone, or message. Only enter your password at login.luxid.lu (opens in a new tab). Do not give out your passwords or verification codes to anyone claiming to provide account or password support. Learn how to recognise legitimate LuxID messages.