![\"Original](\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2026\/10\/rjv-onva-holiday-pay-doccle-scam-original-example.png\" "\\"\\"")
<\/figure>\nOverview<\/h2>\nA holiday-payment notice borrows trusted document branding<\/h3>\n
The RJV holiday pay scam uses false emails and texts to impersonate Belgium’s annual-holiday institution, also known by the French abbreviation ONVA.<\/p>\n
One version resembles a Doccle document notification. Other messages ask recipients to provide account information through a link connected to their holiday payment.<\/p>\n
These aren’t complaints about a legitimate holiday benefit. RJV explicitly identifies the messages as phishing<\/a>.<\/p>\n The institution, Doccle, and itsme are legitimate services. Their names are being used to make a fraudulent instruction feel administrative.<\/p>\n The danger isn’t merely that someone learns your bank account number. Some variants push people toward bank authentication or a payment approval.<\/p>\n When you’re expecting money, it’s easy to read an approval as another step toward receiving it. Check what the approval actually does.<\/p>\n The message’s branding doesn’t explain what you’re authorizing. Read the action shown by the genuine authentication service, not just the email’s promise.<\/p>\n Safeonweb’s May 2026 campaign warning<\/a> reported more than 14,000 forwarded copies during the preceding week.<\/p>\n That’s a historical reporting figure, not a count of people who lost money. It still shows why this deserves more than a one-off warning.<\/p>\n Check holiday-pay information by opening RJV’s official service yourself. Don’t let the email choose the route into your banking or identity app.<\/p>\n A document notice doesn’t need a dramatic promise. It asks for a small, familiar action: sign in and read something waiting for you.<\/p>\n That modest request can lower your guard. You’re not apparently buying anything or making an investment; you’re catching up on personal administration.<\/p>\n Holiday pay gives the notification an appealing subject. If you’re expecting a payment, a message about confirming details may sound helpful rather than intrusive.<\/p>\n The impersonator benefits from that expectation even without knowing whether you’re actually entitled to money. A broadly distributed message will find some people waiting.<\/p>\n The original example shown above has the appearance of a document alert, while the expanded sender information points elsewhere.<\/p>\n The red annotation belongs to RJV’s published warning image. It highlights the mismatch without requiring you to visit the fraudulent destination.<\/p>\n Notice what the mismatch tells you: this sender isn’t authenticated by the visible RJV label. It doesn’t tell you the identity of the person responsible.<\/p>\n There’s no need to establish that person’s identity before refusing the request. The institution has already warned against this method of collecting information.<\/p>\n The opening connects the message to holiday money or a new official document. The recipient is invited to resolve the matter through a supplied link.<\/p>\n Names can vary with language and presentation. RJV and ONVA refer to the same Belgian institution, so switching abbreviations doesn’t make a message independently trustworthy.<\/p>\n Don’t assume a familiar email thread, correct season, or recognizable subject confirms the message. Check where the requested action actually takes place.<\/p>\n A Doccle or eBox reference makes the next step look like ordinary document access. The sign-in button offers a convenient route forward.<\/p>\n The button’s label isn’t its destination. A link that says \u201csign in\u201d can still lead to a page controlled by somebody else.<\/p>\n On a computer, you can inspect a destination without opening it. If a phone makes the address difficult to inspect, skip the link altogether.<\/p>\n You don’t lose a real entitlement by choosing a safer route to the real account. Start from the institution’s website instead.<\/p>\n The destination can imitate an official page and ask for personal or banking details. The request is framed as preparation for receiving the payment.<\/p>\n At that point, the recipient may already feel committed. They clicked to finish an administrative task, so another form can seem like normal procedure.<\/p>\n Don’t supply extra information to make a suspicious page work. A request becoming more detailed isn’t evidence that the institution needs those details.<\/p>\n RJV provides an independent way to communicate or change an account number. You don’t have to use a link received in an unexpected notification.<\/p>\n Some attempts invoke Digipass or itsme. These names can be used to steer the victim toward approving something different from simply reading a document.<\/p>\n An authentic app prompt can still relate to an action initiated by a fraudster. The fact that your app opened doesn’t validate the email’s explanation.<\/p>\n RJV tells users of its official service to check for the expected government-login description in itsme. Refuse an unexpected action or payment confirmation.<\/p>\n Don’t read out authentication codes to a caller who offers to help complete the holiday-payment process. That continues the unverified request rather than checking it.<\/p>\n The final instruction may seek sensitive account access or a transfer approval. The supposed incoming payment distracts from what the bank screen actually says.<\/p>\n If an amount, payee, or transaction appears that you didn’t initiate, stop. Don’t approve it because the preceding page promised money would arrive.<\/p>\n Not every copied message will use every stage. The consistent warning is the impersonation and the link-led request for information or authentication.<\/p>\nA login story can turn into a payment request<\/h3>\n
\n
This campaign has official, large-volume reporting<\/h3>\n
Why a Document Notification Makes Such Good Bait<\/h2>\n
How the RJV Holiday Pay Scam Works<\/h2>\n
Step 1: An email or text announces a payment-related update<\/h3>\n
Step 2: Familiar logos encourage the click<\/h3>\n
Step 3: A false RJV page asks for information<\/h3>\n
Step 4: Authentication is presented as a harmless formality<\/h3>\n
Step 5: The recipient is pushed to complete the wrong action<\/h3>\n
Check Your Real Holiday Pay Without Using the Message<\/h2>\n