Skip to main content
Version 1.1In review

Recognise legitimate LuxID messages

Why this matters​

Phishing attacks often impersonate trusted services to trick you into sharing your password or personal information. Knowing what legitimate LuxID communications look like helps you spot fakes and protect your account.

Emails from LuxID​

LuxID sends emails from two addresses, each with a different purpose:

  • notification@msg.luxid.lu - Transactional account notifications (account creation, email verification, password changes, account updates). These emails are always triggered by an action you or someone on your account initiated. They are never promotional.
  • support@luxid.lu - Replies from the LuxID support team, in response to a support request you have sent.

If you receive an email claiming to be from LuxID but sent from a different address, do not click any links or download any attachments.

What LuxID emails look like​

  • They are related to an action you recently performed on your LuxID Account.
  • They never ask you to share your password in a reply.
  • Links in the email point to login.luxid.lu, account.luxid.lu, or www.luxid.lu - hover over any link to check before clicking.
  • They may contain a verification code that you enter on the LuxID page yourself. LuxID will never ask you to send a code back via email.

The name shown on an email (for example "LuxID") can be set to anything, so check the details yourself rather than trusting the name.

Two email headers compared: a genuine one whose address ends in msg.luxid.lu is highlighted, and a fake one whose display name says LuxID but whose address ends in luxid-support.com is flagged.

Reveal the real sender address:

  • On a computer, click the sender's name, or the small arrow or Details next to it, to expand the full email address.
  • On a phone, tap the sender's name at the top of the message to see the full address.
  • A genuine LuxID email address ends exactly in @msg.luxid.lu or @luxid.lu. Be wary of look-alikes such as notification@luxid-support.com or notification@msg.luxid.lu.example.com - the real domain is the part just before the first / or the end of the address.

Check where a link goes before you open it:

  • On a computer, rest your mouse pointer on the link without clicking - the real destination appears at the bottom of the window or in a small tooltip.
  • On a phone or tablet, press and hold the link (do not tap it) until a preview of the real address appears.
  • The destination should be on login.luxid.lu, account.luxid.lu, or www.luxid.lu. If it points anywhere else, do not open it.

Once you reach a LuxID page, you can also confirm you are not on a copy - see Check you're on a genuine LuxID page.

SMS from LuxID​

LuxID SMS messages are sent with the sender name LuxID.

note

In some countries, local regulations may replace the sender name with a short code number (e.g., in Belgium). Some countries may also automatically append a "STOP" instruction to the message - this is added by the carrier, not by LuxID. LuxID has registered the "LuxID" sender ID in countries that offer this option, but this is not a guarantee that the message will arrive with our name displayed, nor that someone else cannot spoof our sender ID.

The only purpose of LuxID SMS messages is to deliver a one-time code​

LuxID will never send you an SMS with a link, a request to call back, or a request for personal information. A legitimate LuxID SMS only delivers a code, and contains:

  • Your one-time code
  • A transaction reference - a short code that also appears on the LuxID page asking for the one-time code, so you can confirm the SMS matches your current sign-in attempt
  • The expiry time of the code (valid for 15 minutes)
  • A domain tag for LuxID that some phones use to offer the code for automatic filling

If you receive an SMS claiming to be from LuxID that does not follow this format, or that asks you to click a link or share information, do not respond.

A phone messages screen: a genuine LuxID text shows only a one-time code with no link, while a fake text creates urgency and contains a link to luxid-verify.com, which is flagged as fake.

Voice calls from LuxID​

As an alternative to SMS, LuxID can deliver your One-Time Code via an automated voice call. These calls originate from:

  • Phone number: +33 7 55 53 18 32 (French number)

The reason for the French number is that machine-to-human voice calls are well regulated in France, and LuxID complies with this regulation.

The only purpose of LuxID voice calls is to dictate your one-time code​

The automated call reads your code aloud. LuxID will never:

  • Ask you to share personal information during a call
  • Ask you to press buttons or interact with a menu
  • Ask for your password or verification codes
  • Call you from this number for any reason other than delivering a code you requested

If you receive a call from someone claiming to be from LuxID and asking for information, hang up and contact LuxID support.

Make sure you're on the real LuxID page​

A link in a message is only safe if it takes you to a genuine LuxID address. Before you type your password or a one-time code, confirm you are on a real LuxID page (login.luxid.lu or account.luxid.lu) and not a look-alike copy. See Check you're on a genuine LuxID page for the full checklist of address, connection, and password-manager checks.

How to spot a fake message​

Be cautious if a message:

  • Comes from an unfamiliar sender address or phone number
  • Creates a sense of urgency ("Your account will be deleted in 24 hours")
  • Asks you to click a link that does not point to luxid.lu
  • Asks you to share your password, verification code, or personal details by replying
  • Contains spelling mistakes or unusual formatting
  • Arrives without you having initiated any action on your LuxID Account (remember: LuxID notifications are always transactional - triggered by something you did)
Watch for real-time code phishing

A dangerous scam shows you a fake LuxID page that asks for your password and then, seconds later, for your one-time code - relaying both to the attacker in real time. If a page or person asks for your code right after your password but you did not start this sign-in yourself, stop and do not enter it. Only enter your code on a sign-in you began at login.luxid.lu.

What to do if you suspect a phishing attempt​

  1. Do not click any links or download attachments. If you need to access your LuxID Account, type the address manually in your browser (e.g., login.luxid.lu or account.luxid.lu).
  2. Do not reply with personal information.
  3. Do not share your One-Time Code - it is meant only for the LuxID page where you initiated the action.
  4. Report the phishing attempt - see Report a phishing attempt below.
  5. If you already clicked a link or entered your password on a suspicious site, change your password immediately and review your account for suspicious activity.

Report a phishing attempt​

If a message claiming to be from LuxID turns out to be fake, or you think you have been caught by one, report it. Reporting helps POST's security team investigate and block the campaign, which protects you and other users.

Send your report - with a screenshot, the sender's phone number, or the forwarded email - to POST Luxembourg's CyberSOS incident team. See Report a phishing attempt or scam for how to reach them and exactly what to include.

If you are simply unsure whether a message is genuine and want it checked, you can also ask LuxID support. Remove any personal information (such as your password or full phone number) before sending.

Updated 2026-07-02
On this page