Customers have been scammed out of thousands of euros by fraudulent websites imitating the Banque Internationale à Luxembourg (BIL) and the Luxtrust verification service, with little being done to close the webpages down, deputies have said.
A number of customers have contacted the Luxemburger Wort throughout July to report that they have lost thousands after attempts to access the bank’s website via search engines led them to fraudulent sites.
Around 20 people, according to the police, have filed a complaint, each involving losses between €6,500 and €9,900.
LSAP deputies Mars Di Bartolomeo and Ben Polidori have tabled a parliamentary question amid concerns that, despite complaints being lodged, little appears to have been done to close the sites quickly and prevent further attacks, they say.
Their parliamentary question calls for an explanation as to how it is possible “that such fake sites can remain active for weeks or even months, even though the victims quickly provided information and filed a complaint.”
“What is the current legislation in place to combat such attacks? And what security measures are in place to protect citizens digitally?,” they asked in their question, submitted on Wednesday to the ministers of finance, media and justice.
The LSAP politicians are also interested in the extent of the responsibility of the financial instutions concerned if customers suffer financial losses as a result of such fraud, querying whether there are guidelines for compensation in place.
€8,800 stolen
Following a report in the Luxemburger Wort, another victim – who wished to remain anonymous – came forward on Wednesday evening to report that €8,800 had been withdrawn from her current account at BIL on Thursday 24 July by a woman she did not know from France.
“I didn’t receive a call from BIL or a message from LuxTrust to confirm this transaction, even though it was a very large amount. I’ve been saving up for a long time,” said the victim.
A few minutes after the allegedly fraudulent instant transfer was made, she telephoned BIL and explained “that I did not make this transfer and that it should be stopped”, but was told that was not possible.
“BIL has blocked my account and my cards. I was told they would look into the case and I would get an answer within four to six weeks. I feel left in the lurch,” she said.
She has since learnt that on Wednesday 23 July, another BIL client was defrauded in the same way and for the same amount, €8,800, also through an instant transfer to France.
“Banque Internationale à Luxembourg is not a safe bank,” the victim told Luxemburger Wort. It cannot be true that BIL is unable to stop the fraud, the woman said in frustration.
BIL has published a warning on its website, stating that online banking portals should never be accessed via a link displayed in a search engine.
EU directive
The European Commission intends to strengthen consumer protection as part of the Second Payment Services Directive (PSD2), particularly with regard to liability issues in online banking fraud.
This includes adjustments to the liability regime of PSD2 in order to better protect consumers from unauthorised payments and fraud, as in the case of the fake BIL page.
Until now, PSD2 has regulated liability for unauthorised transactions, whereby consumers are generally liable up to a maximum amount of €50, unless gross negligence or fraud can be proven.
The European Commission is now planning to provide for compensation in cases of fraud in which fraudsters pretend to be employees of payment service providers in order to deceive consumers.
In future, refunds for unauthorised payments can only be refused “if the customer has acted fraudulently”, as stated in the proposal.
The time that payment service providers have to check and process cases of fraud is to be reduced to ten days if there is reasonable suspicion of fraud.
PSD3 is expected to come into force in the first half of 2026. Member states will then have 18 months to incorporate PSD3 into national legislation.
(This article was originally published by the Luxemburger Wort. Machine translated, with editing and adaptation by Alex Stevensson.)