Fake Police Letters

Someone is sending fake police correspondence in Luxembourg. Emails and physical letters, both claiming to be from the police, asking recipients to hand over passwords, bank details, or other sensitive information as part of a supposed investigation [1]. The police confirmed the reports on July 5 and issued a public warning.

This is not a sophisticated cyberattack. It is a confidence trick with a letterhead. That is exactly what makes it dangerous. People trust the police. When an official-looking document arrives referencing an investigation, the instinct is to cooperate, not to question.

How it works

The scam follows a familiar pattern. A resident receives an email or a physical letter that looks like it came from Luxembourg police. It references a police investigation and asks the recipient to provide personal information, click a link, or open an attachment. Sometimes the documents look convincing. Sometimes they are riddled with spelling mistakes, which police say is a common red flag [2].

The goal is always the same: extract passwords, bank credentials, or enough personal data to enable further fraud. The fake investigation angle is clever because it creates urgency. Nobody wants to ignore the police.

What the police are saying

Luxembourg police published concrete guidance [3]:

• Ignore suspicious emails or letters. Do not respond, do not click links, do not open attachments.
• Check for spelling mistakes. Official correspondence is proofread. Frequent errors are a warning sign.
• Contact the police if in doubt. If a document looks plausible but something feels off, verify before acting.
• Never transmit sensitive data by email or online messaging. The police will never ask you to send passwords or bank details this way.
• Talk to elderly relatives. Police specifically asked people to inform older family members and friends about the scam.

That last point is worth pausing on. Scams like this disproportionately target older people, who may be less familiar with phishing tactics and more inclined to trust official-looking correspondence. The police know this, which is why they asked the public to spread the word personally rather than relying solely on a press release.

Why this keeps happening

Phishing campaigns are cheap to run and scale effortlessly. Sending 10'000 fake emails costs practically nothing. If even one person hands over their banking credentials, the campaign pays for itself. Physical letters cost more but carry an aura of legitimacy that emails have lost. A letter on what looks like police letterhead, delivered to your mailbox, feels real in a way that a badly formatted email does not [4].

The shift from email-only to email-plus-letters is notable. It means the scammers are investing slightly more per target, which suggests the returns are good enough to justify the extra cost. That is not encouraging.

What to actually do

If you receive a communication claiming to be from Luxembourg police that asks for personal information:

1. Do not click any links or open any attachments.
2. Do not reply, even to say you will not comply.
3. Look for spelling mistakes, inconsistent formatting, or generic greetings instead of your name.
4. If you are genuinely unsure, call your local police station directly. Use the phone number from the official police website, not the one in the suspicious document.
5. If you already responded or handed over data, contact the police immediately and change any passwords you shared.

The simplest rule is the one the police themselves emphasized: when in doubt, do nothing. Real police procedures do not require you to email your password to anyone.