Receiving messages from LuxID

How LuxID contacts you

LuxID may send you messages by email, SMS, or voice call. Here is how to identify legitimate messages:

• Email notifications are sent from notification@msg.luxid.lu. Always check the sender address carefully.
• SMS messages are sent with the sender name LuxID (this may vary depending on your country and mobile carrier).
• Voice calls for one-time codes come from +33 7 55 53 18 32.

Types of messages you may receive

LuxID sends messages for the following reasons:

• Account activation - After creating your account, you will receive an email to confirm your email address.
• Password reset - If you (or someone else) requested a password reset at the password reset page (opens in a new tab).
• 2-Step Verification codes - One-time codes sent by SMS or voice call when you sign in with 2-Step Verification enabled.
• Security alerts - Notifications about suspicious activity on your account, such as sign-in attempts from unfamiliar locations.
• Email change verification - If you change the email address associated with your account, you will receive a verification message at the new address.

Unrequested password reset messages

If you received a password reset email that you did not request, it is likely that another user entered your email address by mistake. This does not mean your account has been compromised. You do not need to take any action - simply ignore the message.

If you receive these messages repeatedly, consider enabling 2-Step Verification for additional security.

For more details, see Unrequested password reset messages.

Unrequested verification codes

If you receive a One-Time Code by SMS or voice call that you did not request, it usually means someone entered your phone number by mistake while signing in or registering. This alone does not put your account at risk.

• Never share the code with anyone. A genuine LuxID code is only ever entered on the LuxID page where you are signing in - LuxID will never call or message you to ask you to read a code back.
• You do not need to do anything - an unused code simply expires.
• If you receive these codes repeatedly, contact LuxID support so we can look into it.

Suspicious sign-in alerts

If you receive a security alert about a sign-in attempt you do not recognise, take the following steps:

1. Sign in to your LuxID Account (opens in a new tab).
2. Go to Security and review recent activity.
3. If you see activity you do not recognise, change your password immediately.
4. Enable 2-Step Verification if you have not already done so.

How to tell if a message is really from LuxID

Be cautious of any message that:

• Asks for your password or other sensitive information directly.
• Contains links to unfamiliar websites that are not on the luxid.lu domain.
• Urges you to act immediately with threatening language.

LuxID will never ask you to share your password by email, SMS, or phone. If you are unsure whether a message is legitimate, do not click any links. Instead, go directly to the LuxID sign-in page (opens in a new tab) in your browser.

What to do if you think your account is compromised

1. Go to the password reset page (opens in a new tab) and reset your password.
2. Sign in to your LuxID Account (opens in a new tab) and review your security settings.
3. Enable 2-Step Verification if it is not already enabled.
4. If you need further help, contact LuxID support.

For a full step-by-step walkthrough, see Secure a compromised LuxID Account.

Check your spam or junk folder

If you are expecting a message from LuxID but have not received it, check your spam or junk folder and make sure your mailbox is not full. You can also add notification@msg.luxid.lu to your contacts or safe senders list to prevent future messages from being filtered.

If your email provider holds messages for approval

Some mailboxes - especially work or organisation accounts - use an email-protection system that does not simply filter messages into a spam folder. Instead, it holds messages from unfamiliar senders in a separate quarantine and asks a person to manually approve ("release") them before they reach your inbox. These systems are sometimes called challenge-response or "mail release" filters.

LuxID messages can get caught this way. Because LuxID sends from an automated, unmonitored address, LuxID cannot answer the approval request on your behalf - only you or your IT team can. The message is not lost, but it stays in quarantine until someone releases it, which means it can look as though LuxID never sent anything when it did.

What you can do:

• Personal mailbox with this kind of protection - Open your provider's quarantine or "held messages" area, release the LuxID message, and add the LuxID sending domains msg.luxid.lu and luxid.lu to your trusted or allowed senders so future messages arrive directly.
• Work or organisation mailbox - Ask your IT administrator to allow (whitelist) the LuxID sending domains msg.luxid.lu and luxid.lu, or to release the held message from quarantine. A single domain-level rule lets all future LuxID messages through.

If you have released the message and allowed the LuxID domains but messages still do not arrive, contact LuxID support.