De Lijn MOBIB Scam: A Failed Identity Check Becomes a €1 Card Details Trap

Your travel card is supposedly suspended, and an email says you must verify it to keep your subscriptions. There’s a prominent yellow button to fix things.

For anyone relying on public transport tomorrow, that sounds like a problem worth sorting out tonight. The proposed solution is where the trouble starts.

Overview

A threatened travel-card suspension leads to a false verification page

The De Lijn MOBIB verification scam impersonates the Belgian transport operator and tells subscribers to reactivate or verify their travel card through an email link.

De Lijn’s official phishing warning documents the email and the imitation pages behind it. The real operator isn’t requesting this fraudulent verification.

The example threatens permanent deactivation and lost subscriptions if the reader misses a deadline. That pressure is designed to make the button feel necessary.

The published example is older, not a newly discovered deadline. Its date doesn’t make the documented method any safer if a similar message arrives.

A deliberately broken identity check creates the next request

After collecting personal details, the imitation site presents an itsme identity check that intentionally fails. It then asks for a €1 payment.

The payment also displays an error, according to De Lijn. The real purpose of that screen is collecting card information, including the security code.

That’s why “payment failed” isn’t a reassuring ending. Information entered into the form can already be exposed without a successful €1 transaction.

• The email claims your MOBIB card needs urgent attention.
• The verification link opens a site resembling De Lijn’s homepage.
• A personal-information form leads to an unsuccessful identity check.
• A small card payment is offered as the way forward.
• An error screen hides the importance of the card details already submitted.

The amount is small; the information isn’t

The scam isn’t simply an attempt to collect €1 from every commuter. The low amount makes a sensitive card-entry step feel easier to accept.

Don’t follow the email to repair your card. Check the actual subscription through De Lijn’s genuine service or independently reached customer support.

If you entered card details, tell the issuer even if the form failed. Waiting for an unfamiliar charge can give the impersonator more time.

Why a Broken Check Can Make the Scam More Convincing

People are used to online processes failing. A temporary identity-service problem can feel frustrating but ordinary, especially when a website offers another way to continue.

In this case, the failure is part of the route. It creates a reason to request something that the first screen didn’t obviously need.

The reader begins by trying to preserve a travel subscription. A few screens later, they’re entering card data to fix an apparent technical problem.

That change can slip past because the goal hasn’t changed in the reader’s mind. They’re still trying to make tomorrow’s journey possible.

Stop when the requested action changes. A small payment is a financial request, even if the page describes it as verification or a workaround.

The original email above also uses a specific deadline and a formal-looking footer. Those details create structure, not authenticity.

Its visible August 2024 date belongs to that archived example. Don’t mistake it for a current instruction, expiration date, or announcement from De Lijn.

The operator’s warning page remains a useful record of the mechanism. It doesn’t establish how many victims were affected or that every copy looks identical.

How the De Lijn MOBIB Verification Scam Works

Step 1: A false email threatens loss of card access

The message claims the MOBIB card is temporarily suspended. It asks the reader to verify identity before a deadline to avoid permanent deactivation.

For a commuter, that threat reaches beyond a small administrative inconvenience. It suggests losing access to an already paid travel subscription.

The email supplies its own solution immediately. The bright verification button is easier to act on than finding independent customer support.

Before using it, ask whether the issue appears in your real account. The warning itself isn’t evidence that the travel card has stopped working.

Step 2: A copied homepage makes the destination seem familiar

The button leads to a page resembling De Lijn’s real website. Familiar colors and layout help conceal the change in who controls the interaction.

De Lijn specifically identifies the link as going somewhere other than its own website. A convincing copy doesn’t turn that destination into an authorized service.

Don’t enter details to see whether the page recognizes you. That experiment gives information to the same destination you’re trying to investigate.

Open the genuine service separately. If necessary, compare the claimed problem with customer support using contact details you find there.

Step 3: Personal information leads to a false itsme check

The imitation process requests personal details and then offers identity confirmation. The use of a familiar identity-service name makes the procedure seem structured.

But De Lijn says this check is designed not to work. Its failure isn’t an unexpected fault that the reader needs to troubleshoot.

Don’t try extra identity information, another person’s account, or repeated authentication attempts. A suspicious website doesn’t become safer because you help it overcome an error.

The point to stop is when the destination and purpose are unverified, not after you’ve exhausted every offered workaround.

Step 4: A €1 payment is presented as the alternative

The page now asks for a small payment. After the failed identity check, the new request can feel like a practical route around the problem.

Pay attention to what the screen collects rather than only the amount. Card numbers, expiry details, and security codes aren’t low-value information.

A €1 label doesn’t limit what someone might later attempt with exposed card data. Don’t treat it as the maximum possible consequence.

The real question is whether the operator requested this payment through an authenticated process. The false email hasn’t established that.

Step 5: Another error masks the completed disclosure

De Lijn explains that the apparent payment doesn’t complete and the page displays an error. The card information has been the target of the form.

No ticket and no €1 charge can feel like nothing happened. They don’t tell you whether the form captured your card details.

If you submitted the card fields, report that exposure to the issuer. You don’t need to reproduce a successful fraudulent charge first.

Don’t return with a second card to finish the verification. That can expand the exposure without solving any genuine travel-account problem.

How to Check Whether Your Travel Subscription Really Needs Attention

Start from De Lijn’s official website, app, or an existing trusted account bookmark. Don’t use the link whose authenticity you’re questioning.

Review the subscription and any genuine account notices. Keep the card or customer reference available if you need to ask support about a specific issue.

Use a contact route published by the operator. A phone number supplied by the threatening email belongs to the same unverified story.

If a real subscription is approaching renewal, complete the ordinary process through the genuine service. Don’t assume every renewal reminder is false.

Likewise, don’t ignore a genuine card problem because you also received phishing. Separate the real account status from the fraudulent method offered to fix it.

When helping a relative, open the correct service together rather than taking over an approval they don’t understand. Explain what each screen is asking.

If you can’t confirm the status before traveling, ask the operator about legitimate options. Don’t use an unverified payment form simply to escape uncertainty.

Other De Lijn Offers Should Be Checked Separately

The operator also warns about false social-media posts offering free or extremely cheap six-month subscriptions. Those posts use a different opening promise.

Don’t assume every fake Facebook offer follows the exact MOBIB failure sequence described here. What connects them is unauthorized use of De Lijn’s identity.

A real promotion should be verifiable through the operator’s own communication channels. An advertisement’s popularity doesn’t establish that relationship.

Comments, reactions, and reposts can make an offer feel established. They don’t tell you who controls the linked payment page.

If someone sends the offer in a local group, don’t blame that person for inventing it. They may have shared it without checking.

Give them the official warning and ask them to remove the false link. Avoid reposting the live destination while trying to help other commuters.

For any variant, make the same separation: the real transport operator, the message borrowing its name, and the site receiving your information.

What to Do if You Have Fallen Victim to This Scam

1. Stop the false verification process. Close the page and don’t retry the identity check or payment with another account or card.

   If someone contacts you about finishing it, don’t continue through their instructions. Check the actual travel subscription independently when you’re ready.

2. Contact your card issuer if you entered card information. Explain that the €1 payment showed an error but the details were submitted.

   Ask whether the card should be blocked or replaced and how to review suspicious activity. Follow the issuer’s instructions rather than judging safety from the error screen.

3. Report banking approvals or credentials separately. Tell the bank if you entered login information or approved anything in a genuine authentication app.

   Describe what the app said, not only what the fraudulent website promised. The bank needs to distinguish an identity check from a financial action.

4. Protect any password used on the imitation site. Change it through the real service and replace it on other accounts where you reused it.

   Ask the provider for help reviewing account changes or sessions you don’t recognize. Don’t follow password-reset links sent by the same suspicious contact.

5. Preserve the evidence you already have. Save the original email, full sender information, available URL, screenshots, and records of bank contact.

   Don’t revisit the site to collect a better screenshot. Existing records can show the request without risking another disclosure or accidental payment.

6. Report the impersonation through official routes. Follow De Lijn’s warning and Safeonweb reporting guidance. Tell the police if financial loss or identity misuse occurred.

   Reporting a message helps others, but it doesn’t block your card. Complete urgent bank protection before waiting for a response to the phishing report.

7. Review device exposure only where relevant. If you downloaded or installed anything while following the page, seek reputable assistance and consider a Malwarebytes check.

   AdGuard can help reduce access to known malicious destinations. It doesn’t cancel exposed card details or guarantee that a new lookalike site will be blocked.

What Not to Do After the Error Screen

Don’t assume that an empty bank statement proves the form was harmless. The absence of an immediate charge doesn’t tell you who received the information.

Don’t send your card photo to a supposed support agent who offers to investigate. That supplies more information to an already unverified contact.

Don’t approve a small transaction to “test” whether the site is real. A successful payment would prove only that a payment could be processed.

And don’t feel obliged to finish because you’ve already entered your address. You can stop at any point and reduce further exposure.

The useful next step is a clear report to the relevant provider. Tell it what happened, what information left your control, and whether you approved anything.

Separate a Real Travel Purchase From This Verification Demand

Transport services can have legitimate purchases and renewal procedures. The warning here isn’t that every charge connected to travel is fraudulent.

It’s the false suspension email and copied verification sequence that create the scam. Verify the actual product, price, and account action through the genuine operator.

If you need a ticket while investigating the message, purchase it through an established official channel. Don’t treat the threatening email as your only option.

Keep any genuine ticket receipt apart from the phishing records. Your issuer can then distinguish an authorized travel purchase from information entered on the imitation page.

Explain both clearly when asking for assistance. A real payment to the operator doesn’t make a separate fake verification form legitimate.

Frequently Asked Questions

Is De Lijn asking me to verify MOBIB through this email?

The email and imitation verification sequence documented by De Lijn are phishing. Check any genuine card issue through the operator independently rather than using that button.

Why does the fake itsme check fail?

De Lijn says the failure is deliberate. It creates a reason to move the recipient toward a €1 card-entry step presented as an alternative.

Am I safe if the €1 payment didn’t go through?

No such conclusion follows. The form can expose card details even when it displays an error. Tell the issuer what you submitted.

Does this only matter for credit cards?

Report exposed debit or credit card information. Let the issuer assess the relevant protections and risks rather than assuming one card type can be ignored.

Is the deadline in the original screenshot current?

No. It belongs to the archived fraudulent example. Treat new deadline claims as unverified and check your actual subscription through the genuine service.

Are cheap six-month Facebook offers part of the same page sequence?

De Lijn warns about those false offers too, but that doesn’t establish an identical journey. Verify promotions through the operator, not through social engagement.

The Bottom Line

Don’t use an email’s MOBIB verification button or pay €1 to fix its failed check. Verify the real subscription directly with De Lijn.

If you submitted card details, call the issuer even after a payment error. The De Lijn MOBIB verification scam targets the information, not just the small amount.