eBox file closure: scam or real?

First assess what is being requested, which channel was used and what has already happened. Do not use the received link or imposed phone number as the verification channel.

Information updated : 2026-09-10

High risk - Point de vigilance : The message uses a sensitive administrative document as leverage.

Editorial Trust

Last update
2026-09-10
Sources checked
2026-09-17
Content status
information published with visible sources and clear limits
Official sources cited
5
Editorial responsibility
StopArnaques

StopArnaques is an independent Belgian service. It is not a public authority and does not speak on behalf of the organisations cited.

Report a correction

Analysis of the case described

  • The threat of file closure pushes you to open a document without clearly stating which administration sent it. The fake portal may then ask for identification or an itsme confirmation.
  • An eBox notification must match a document visible in eBox opened separately; the text of the message on its own is not enough.

How the scam works

  • The message imitates an administration or a document portal and uses a refund, a debt or a deadline to force you to click.
  • The fake portal seeks a login, identity data or a payment that do not appear in the official space opened separately.

Why this is dangerous

  • The message uses a sensitive administrative document as leverage.

Warning signs

  • File closure or urgent document
  • Non-official eBox / CSAM link
  • Request for quick login or confirmation

What a legitimate service would do

  • The file is checked by opening MyMinfin, eBox, CSAM, Doccle or the website of the organisation concerned yourself.
  • A real deadline can be confirmed through a contact found on the official domain, never only through the message you received.

Verification steps

  • Open eBox through its official access without clicking the notification.
  • Check the issuing organisation, the title and the date of the document in your space.

What to do now

  • Open eBox or CSAM yourself.
  • Do not enter anything on a portal received by message.

If you already clicked

  • Close the page and go back to the official portal.
  • Change your password if you entered it.

What this sheet allows us to state

  • The wording “eBox file closure” is a search clue, not enough proof on its own. The number, domain, beneficiary and requested action must be checked together.
  • This sheet describes a defensive method. It does not attribute a message to a person or an organisation without verified evidence.

How to use the sources in this sheet

  • The selected references for “eBox file closure” cover the mechanism, the service being claimed and the protection steps. They should be read for the procedure they document, not as automatic proof that every similar message belongs to a confirmed campaign.
  • For the alert “eBox file closure”, the first three references are: Safeonweb - Be vigilant about suspicious calls and SMS messages; Centre for Cybersecurity Belgium - Nearly 10 million suspicious messages reported in 2025; Centre for Cybersecurity Belgium - Cooperation with the Federal Judicial Police against phishing. Each link is checked separately and an inaccessible source must be removed or replaced.

What would confirm or weaken the risk

  • The risk is stronger if several signs appear together: file closure or urgent document; non-official eBox / CSAM link; request for quick login or confirmation. An irreversible action, an external domain or an unknown beneficiary carry more weight than a simple language mistake.
  • For “eBox file closure”, the risk is weakened if the same request, with the same reference and the same action, is found in the official space opened manually. This match must be checked without using the link, number or QR code received.

Limits of this page

  • This page does not prove that a message is safe and does not replace your bank, the police, Safeonweb, a platform or a public service.
  • A scam may be new, very well written or described with too little context. Use the result as decision support, not as absolute certainty.
  • Before taking a final action, checking through the official channel matters more than the appearance of the received message.

Check through an official channel

  • Type the service address yourself or open the official app. Do not use a phone number, link or QR code from the suspicious message to verify the situation.
  • When money, card details, a code or account access are involved, the safety action comes first. The analysis can then help organise the evidence.

How to read the result

  • A low number of signals does not mean that everything is safe. It only means that this page or analysis did not find decisive evidence with the information available.
  • Focus on the requested action: paying, sharing a code, installing an app, approving a bank action or leaving an official platform. That action matters more than a logo, sender name or polished wording.
  • If the situation feels urgent, step away from the received message first. Then check calmly through a channel you already trusted before the message arrived.

Belgian reading of this situation

  • For this ebox file closure situation, focus on the relevant Belgian next step: open the official channel yourself, contact the bank, use Safeonweb or preserve evidence.
  • The right decision for this ebox file closure situation depends on what has already happened. Reading a message is not the same as clicking, paying, sharing a code or granting remote access.

eBox closure-file angle

  • This alert focuses on an eBox notification claiming that a file will be closed or that an administrative document must be opened urgently.
  • The check is to open eBox or the official public-service portal manually, then compare the document title, administration, date and reference.
  • Distinct markers include eBox, closure, administrative file, public-service portal, official document, notification, deadline and manual login.
  • Use this page when the message claims that an eBox document is waiting or that an administrative file requires urgent action.
  • If the message mainly pushes a CSAM login flow, Doccle mandate or private document platform, the Doccle-CSAM page is the narrower match. This page remains centred on eBox as the claimed destination.

Frequently asked questions

How can I check the file without using the message link?

Open the official portal yourself, such as MyMinfin, eBox, CSAM or Doccle, and look for the notice there.

Can a genuine public service send an urgent notice?

It can, but the same file, refund, debt or deadline must be independently visible in the official account. The message alone is not proof.

What if I already paid or supplied identity details?

Contact the relevant service through official details. Alert your bank when payment or banking data is involved and preserve all evidence.

Useful official sources

Test another suspicious message

Search for similar campaigns