Reporting Fraud in Luxembourg

Knowing where to report cuts hours off your recovery. Here's the map, by situation.

Most advice tells you to "report it" without saying to whom. In Luxembourg there are several bodies, each for a different job. This page tells you exactly which one, in what order, for what.

Who does what

Police Grand-Ducale — the criminal complaint

File a plainte when there's an actual crime: money stolen, identity misused, blackmail, fraud. An online pre-declaration speeds the in-person step. Banks and insurers usually need the case reference before they'll process a fraud reimbursement — so this is often a required, not optional, step.

Your bank — the money

For anything touching a card or account, the bank is first, because freezing and flagging is time-critical. Use the number on your card, never one from a message. Ask them to block the card/account and dispute fraudulent transactions.

SPAMBEE (NC3 / spambee.lu) — emails & SMS

Report and dispose of phishing or scam messages. It also helps protect others, since reported content feeds shared protection.

CIRCL — phishing URLs & incidents

The Computer Incident Response Center Luxembourg. Use its URL-Abuse service to report a phishing website, and its reporting form (including an anonymous option) for security incidents. CIRCL collects and analyses reports from companies and individuals.

CNPD — your data rights

The data-protection authority. Go here when a company mishandles your personal data or won't honour your GDPR rights (see Your GDPR rights).

BEE SECURE Helpline — advice and reassurance

A consumer-facing line for advice on online safety and what to do next. Good when you're unsure and want to talk to a person.

CSSF — financial-sector warnings

The financial regulator publishes warnings about fake banks, fake investment platforms, and impersonation of itself or supervised firms. Check it to confirm whether a "financial" message is a known scam.

cyberfraud.lu — the front door

The official Luxembourg anti-cyberfraud platform — a good orientation point if you don't know where to begin.

A simple decision path

1. Did money move or could it? → Bank now, then plainte.
2. Was it a message? → SPAMBEE.
3. Was it a website? → CIRCL URL-Abuse.
4. Is it about your personal data being misused? → CNPD.
5. Just want guidance? → BEE SECURE Helpline / cyberfraud.lu.

You can — and often should — do several of these. Reporting the phishing message and filing a plainte and calling your bank are not mutually exclusive.

If you're mid-incident right now

→ I've Been Hit walks you through the first five minutes and the situation-specific steps.