Consumer Rights · Scam Alert · October 1, 2026, 5:10 AM CDT · Updated 5:36 PM CDT
Key Facts
- RTL Today reported on October 1, 2026 that phishing emails aimed at users of the Wero payment app are already in circulation in Luxembourg.[1]
- The email says the recipient must renew a “security certificate”; its button leads to a site that asks for personal details.[1]
- RTL says the message was sent from a South African address, and its advice is to delete it without clicking.[1]
A phishing email aimed at Wero users is already circulating in Luxembourg, RTL Today reports.[1]
The first fake messages appeared soon after Payconiq users were asked to switch to Wero.[1]
The email claims the recipient has to renew a security certificate to avoid problems when moving to the new app.[1]
Its button leads to a site where people are asked to enter their personal details. RTL says a closer look shows the message was sent from a South African address.[1]
RTL calls it “clearly a phishing attempt” and says users should not click the link but delete the email.[1]
What the Scam Looks Like
This is the email, as RTL Today published it. It is written in French and uses Wero’s branding: a Wero logo at the top and a purple banner.
Its headline reads “We would like to inform you of an important update concerning Payconiq.” The body says Payconiq ceased its services in Luxembourg on September 30, 2026, and that to avoid interruption the reader must renew their certificate. The button says “Renouveler mon certificat” (Renew my certificate). The English is our translation.
The shutdown date is the scammers’ claim. We have not confirmed it, and it should not be read as a statement of fact about Payconiq.
Red Flags You Can See in It
- It was sent from a South African address, according to RTL, not from anything connected to Wero or Payconiq in Luxembourg.
- It asks you to “renew a certificate” to keep your service working, which is not something an ordinary payment-app user has to do.
- It sets a deadline-style threat: act now or your service is interrupted.
- Its single button leads to a page that asks for your personal details.
How to Protect Yourself
- Do not click the button. Delete the email, as RTL advises.
- To check anything about your account, open the Wero app yourself, or type the provider’s address into your browser. Do not use a link from an email.
- If you already entered details on a page like this, contact your bank at once and change the password on anything that reused it.
How to Verify This Yourself
Read the original report at today.rtl.lu. It is the source for everything above, and the screenshot is published there.
References
- RTL Today. Following Payconiq switch: Phishing scam targeting Wero users already in circulation. October 1, 2026. ↩
Investigative methodology: this post was first produced automatically from RTL Today’s alert, which it quoted without any example of the scam. It was revised by hand from RTL’s report and the screenshot of the email that RTL published. The English translation of the email’s French text is ours. The email shown is the one RTL published.
Kemetic Minds Editorial Desk
Verified NewsroomPrimary-sourced investigative intelligence on civil rights, voting rights, federal policy, and consumer protection. Sourced from primary legal filings, government statistics, and direct field reporting.