Check you're on a genuine LuxID page
Why this matters
Phishing sites copy the look of a real website - a bank, an email provider, or LuxID - to trick you into typing your password or one-time code on a page that is not the genuine one. Before you enter your LuxID details anywhere, take a few seconds to confirm you are really on a LuxID page. The checks below are quick, and the address is the one that matters most.
Check the web address
LuxID only ever asks for your password on its own addresses - login.luxid.lu (to sign in) and account.luxid.lu (to manage your account). Look at the full address in your browser's address bar, not just at the page content. A genuine LuxID address is exactly luxid.lu or a name ending in .luxid.lu.
How to see the full address
Browsers often shorten what they show, so reveal the complete address before you read it:
- On a computer: click once inside the address bar. The browser then shows the full address, including the
https://part it normally hides. - On a phone or tablet: the address bar may shrink or disappear as you scroll. Scroll back to the top of the page and tap the address bar once to reveal the full address.
How to read the address
Find the part right before the first single slash (/) - that is the real website you are on. Read it from the right:
- A genuine LuxID address ends in
luxid.luimmediately before that first slash - for example, inhttps://login.luxid.lu/auth/loginthe website islogin.luxid.lu. - Everything after the first slash (the
/auth/loginpart) is just the page and does not change which website you are on - so ignore it when checking. - If the part before the first slash is anything other than
luxid.lu(or a name ending in.luxid.lu), you are not on a LuxID page.
Watch for look-alike addresses
Attackers register addresses that resemble the real one. Be suspicious of:
- Swapped or replaced letters - for example
luxld.luorlux1d.lu. - Extra words around the name - for example
luxid-login.com, orluxid.luplaced before a different domain such asluxid.lu.example.com(the real domain is the part just before the final.lu). - A different ending -
.com,.net, or another country code instead of the genuine.lu.
If the address is not exactly luxid.lu (or a name ending in .luxid.lu), do not enter anything.
Look for the secure-connection padlock
The address should start with https:// and show a padlock icon. A missing padlock or a certificate warning is a clear sign to stop.
A padlock only means the connection is encrypted - it does not prove the site is LuxID. A phishing site can also show a padlock. Always check the address as well.
Reach LuxID yourself
The safest way to sign in is to type login.luxid.lu into the address bar yourself, or use a bookmark you saved earlier. Avoid signing in through a link you received by email or SMS, even if it looks correct.
Let your password manager confirm it
If you use a password manager, it will only offer to fill your LuxID password on the genuine LuxID address. If it does not offer to fill in your details on a page that claims to be LuxID, treat that as a warning and double-check the address before continuing.
What about the LuxID logo?
A wrong, blurry, or outdated logo is a red flag - but a correct logo proves nothing. Attackers copy logos exactly, so the way a page looks is not a reliable test. Trust the address, not the appearance.
If something looks wrong
- Do not enter your password or one-time code.
- Open a new tab and reach LuxID yourself by typing
login.luxid.luor using your bookmark. - Report it - the fake page, and any suspicious email, SMS, or call in LuxID's name. Reporting helps POST's security team investigate and block it, which protects you and other users. See Report a phishing attempt or scam for how to reach the CyberSOS incident team and what to include.
- If you already entered your password on a suspicious page, change your password immediately and review your account for suspicious activity.