Victims of fake BIL website lose over €630,000 in phishing scam

A woman living in Luxembourg is among dozens of customers who fell victim to a phishing scam that mimicked Banque Internationale à Luxembourg (BIL)’s website, with losses already exceeding €630,000.

Maria L., originally from Viseu, said she lost €8,000 in a matter of minutes after entering her details on what looked like the bank’s official page. “I just wanted to check my account, and as always, I Googled bil.net. Without realising it, I went to a fake website that looked exactly like the real one,” she told Contacto.

When she alerted BIL, she was told the transaction could not be stopped because it was an instant transfer. “They told me to go to the police, but I still didn’t get the money,” she said.

Losses mount

Like other victims – including one customer who reported losing €17,500 – Maria L. has criticised the bank’s security systems, pointing to the absence of a LuxTrust confirmation request for the transfer.

The group of affected clients, estimated at around 60 people, is planning to meet in Medernach on Sunday to discuss legal action.

In 2024, police recorded nearly 6,400 fraud cases in Luxembourg, with authorities warning that criminal groups are increasingly using sophisticated techniques to target customers.

Bank response

BIL said it complies with EU laws on strong authentication and stressed that its systems are secure and transactions digitally signed, putting part of the responsibility on customers.

On Sunday the bank said in a statement, it has now decided to file a complaint with the Luxembourg District Court and said it may also pursue a civil case. Complaints have been submitted to foreign institutions where funds were transferred.

“We know that behind every case of fraud, there are victims, some of whom find themselves in great difficulty. We are doing everything possible to support them as best we can and to prevent these situations from happening again,” said Jeffrey Dentzer, BIL’s chief executive according to a statement released by the bank on Sunday.

BIL said that in some cases, despite measures taken, funds transferred by fraudsters cannot be recovered because they are quickly moved abroad. In the July malvertising campaign, for instance, three quarters of the attempted transfers were blocked before execution, and part of the funds were successfully recalled. For other clients, however, “the money was moved too quickly and was no longer in the account, often abroad, used by the fraudster,” the bank said.

This article was originally published by Contacto. Translated using AI, with editing and additional reporting by Kabir Agarwal