Now
In spring 2026, the City of Differdange fell victim to a bank account information fraud scheme that resulted in the payment of more than €400,000 into an account controlled by criminals. The initial information released in late September contained inaccuracies, particularly regarding the dates. The municipal executive committee regrets this. Here is the exact sequence of events, reconstructed by the administration and validated by the Revenue Department.
Our departments conducted multiple verifications before making the payment and detected the fraud within two days. They were dealing with criminals who controlled our partner’s email system and responded to our verification requests. However, the City Council’s communication regarding this matter was not always up to par: the facts were made public too late and contained errors. I regret this. Today we are publishing the full account of the events and have strengthened our procedures. — Guy Altmeisch, Mayor
April 20, 2026 — The City receives, via Peppol, an invoice for €400,000 from the construction company for work in progress. The invoice corresponds to actual services rendered.
May 4 and 5 — In accordance with procedure, the Technical Department asks the architectural firm to confirm the invoice’s accuracy. The firm confirms and authorizes payment. These exchanges are authentic.
May 7 — An email sent from the architectural firm’s email account indicates that the company wishes to know the payment date, with two company employees copied on the message. This email was, in fact, written by the criminals, who had taken control of the architect’s email account; the employees’ addresses were forged. In the days that followed, the criminals used these fake email addresses to request a change to the bank account information. The city required an official document confirming the change, which it received. The architectural firm confirmed this change—from its email account, which was then under the criminals’ control.
May 13 — the invoice was paid using the new account information at a bank in the Netherlands. A payment to a foreign account is nothing out of the ordinary.
May 19 — two business days later, the Revenue Department detected the anomaly and identified the fraud. That same day, the City contacted its bank and the Dutch bank to try to freeze the funds and filed a complaint with the police. Unfortunately, the funds had already been transferred. The City also notified the architectural firm, which discovered that its systems had been compromised and secured them.
September 30 — The City informs the Ministry of the Interior and makes the matter public.
As soon as the City detected the fraud, it fulfilled its legal obligations by immediately notifying the courts and the banks. In the weeks that followed, the City prioritized efforts to recover the funds and ensure the smooth conduct of the investigation, both of which required a certain degree of discretion. Municipal law does not specify a timeframe for notifying the ministry in such cases. However, in hindsight, the College of Aldermen believes that the ministry, the municipal council, and the public should have been informed sooner.
The City is the victim of a criminal offense committed by an organized group. The perpetrators exploited a hack of a legitimate service provider and simultaneously impersonated two of the City’s partners—the construction company and the architectural firm—using the victim’s authentic email account. As a result, the inquiries carried out received responses… from the criminals themselves.
This modus operandi is designed to circumvent standard controls and affects numerous government agencies and companies every year, both in Luxembourg and abroad. This does not exempt the City from learning lessons from this incident.
Audio playback of the page content is active.
Stop playback