On 17 September 2026, the Luxembourg Administration des contributions directes (ACD) issued a formal warning about an ongoing phishing campaign targeting both resident and non‑resident taxpayers. Fraudsters are sending emails that mimic official ACD correspondence, attaching a document titled “cross‑border tax invoice” in an attempt to extract sensitive personal and banking information. The alert emphasises that the ACD never requests passwords, credit‑card details, or immediate payments via unsolicited email. Taxpayers are urged to verify any suspicious communication through the official MyGuichet portal or by contacting the ACD helpline at (+352) 2475 2475. This warning comes amid a global rise in tax‑related cybercrime and underscores the need for heightened vigilance during peak filing periods.
Key Takeaways
- Phishing Vector: Emails impersonate the ACD and include a fake “cross‑border tax invoice” attachment designed to harvest credentials and financial data.
- Official Channels: The ACD confirms it never asks for passwords, PINs, or credit‑card numbers by email; all legitimate interactions occur via the secure MyGuichet.lu platform or the published helpline.
- Recommended Action: Taxpayers should delete suspicious emails, avoid clicking links or opening attachments, and report the attempt to the ACD via the official contact form or by phone.
Disclaimer: This article is compiled and summarized by the AI based on publicly available information and is for general information purposes only. It does not constitute any form of formal tax advice, legal opinion, or basis for performance. Please consult a qualified professional tax advisor or legal counsel for tax advice.
Source: Read Official Announcement