Money can only be realistically recovered before the scammer withdraws it from the recipient's account, so the first call goes to the bank: cancel the transfer, report the recipient's account as suspicious, and file a complaint with a timestamp. Simultaneously, take screenshots of the advertisement and correspondence, and then file a police report, which must be accepted regardless of the amount. A deposit transfer initiated independently is an authorized transaction, so there is usually no statutory refund from the bank. With card payments, chargeback remains. In the report, request compensation based on Article 46 § 1 of the Penal Code.
- Part 1: How to Recognize a Fake Accommodation Offer: eight types of scams, real messages from scammers, warning signs
- Part 2: How to Check an Offer and Pay Safely: verification in ten minutes, photos, records and registers, control call, deposit or advance, contract, payment method
- Part 3: Money Has Already Left (this guide): first hours, bank complaint, chargeback, report template, lawsuit, Polish diaspora
This part of the series is for those who have already paid for accommodation that does not exist or provided the scammer with card details or a scan of their ID. How to recognize a fake offer is described in Part 1, and how to book and pay to have a way out is covered in Part 2. Here, step by step: first hours, bank complaint, chargeback, crime report with a template, civil lawsuit, path for the Polish diaspora, and realistic chances of recovering money.
Money Has Left: The First Hours Are Crucial
There is only one window in which money can be realistically recovered: before the scammer withdraws it from the recipient's account. It counts in hours, not days. Complaints, criminal cases, and civil cases are important but much less effective. Therefore, the following steps should be taken simultaneously, not sequentially.
- Call the bank's hotline and demand three things at once
First, a recall of the transfer, which only works as long as the money has not been settled and withdrawn. Second, report the recipient's account as suspicious: Article 106a of the Banking Law allows the bank to block the funds and notify the prosecutor, who has an unextendable 72 hours to decide. This is the fastest existing lever. Third, record the complaint with a timestamp, as deadlines described below start from it.
- Block your card if you provided its details
Card Blocking System of the Polish Bank Association: +48 828 828 828, available 24/7 from any country.
- Take screenshots before the advertisement disappears
This is the most often overlooked step and the most costly mistake. Screenshots of the entire advertisement with the URL and date, full correspondence (portal chat, SMS, WhatsApp, emails with headers), PDF confirmation of the transfer with the number and name of the recipient, nickname and profile of the seller, phone, email, links to the “property page.” Save copies outside the device. Without screenshots, the case practically dies after the advertisement disappears.
- Block your PESEL number if the scammer received a scan of your ID
Free and immediately through gov.pl/web/gov/zastrzez-swoj-numer-pesel-lub-cofnij-zastrzezenie. Details below.
- Change passwords and enable two-factor authentication
For banking, for the email used in correspondence, and for the account on the advertising portal. If you clicked on a “payment link,” treat the device as potentially infected.
- Report the advertisement to the platform and the site to CERT Polska
Report the advertisement, profile, and messages separately. Report the fake site at incydent.cert.pl, and send suspicious SMS for free to number 8080.
Bank Complaint Depends on One Distinction
The Act of August 19, 2011, on Payment Services in Article 40 § 1 states that a transaction is considered authorized if the payer has consented to its execution in the manner specified in the agreement with the bank. This results in two completely different worlds:
| Unauthorized Transaction | Authorized but Fraudulent Transaction | |
|---|---|---|
| When | The scammer gained access to banking, obtained the SMS code through a fake site, and executed the transfer themselves; stolen card data was used | The victim initiated the deposit transfer themselves, misled about the existence of the accommodation |
| Bank's Responsibility | The bank refunds the amount no later than the end of the next business day after reporting (Article 46 of the Payment Services Act) | The bank is generally not liable because consent was formally given |
| Burden of Proof | On the bank (Article 45 of the Payment Services Act): it must demonstrate authorization or intent or gross negligence of the client | On the client, in a dispute with the scammer, not with the bank |
| Reporting Deadline | 13 months from the account charge (Article 44 § 2 of the Payment Services Act), after which claims expire | Complaint without a statutory claim for refund |
Typical rental scam is the second column. You transferred a deposit knowingly because you believed the house existed. A complaint to the bank then makes sense as a tool to block the recipient's account and build documentation, but not as a basis for automatic refund.
It is different when the scammer set up a fake gateway and executed the operation with your data. Then you are in the first column, and Articles 45 and 46 work in your favor. Describe this precisely in your complaint: authentication is not the same as authorization. A correctly entered SMS code does not prove that the transaction occurred at your will if it was obtained fraudulently. Both UOKiK and the Financial Ombudsman pay attention to this.
The deadline the bank will not remind you of
The Act of August 5, 2015, on the consideration of complaints by financial market entities gives the bank 30 days to respond (Article 6). In particularly complicated cases, this can be extended to 60 days, but it must notify you and indicate a new deadline (Article 7). The most important is Article 8: if the bank does not meet the deadline, the complaint is considered resolved according to the client's will.
Therefore, the complaint should be submitted in writing, with solid proof of the date of receipt (registered letter or form in banking with a screenshot and report number) and with a specific monetary demand. Silence from the bank for 30 days then works in your favor.
Chargeback Works Only with Card Payments
Chargeback, or return charge, has no basis in law. It is a procedure from Visa and Mastercard regulations, binding on issuing banks. You submit the request as a complaint, and it is protected by the deadlines described above.
Chargeback does not work with regular transfers, with BLIK (a separate payment scheme, outside card networks), or with pay-by-link through PayU or Przelewy24 paid by transfer. It works when you paid by card, also via PayU or Przelewy24. You submit the complaint to the bank that issued the card, not to the intermediary. The statement shows the name of the intermediary, so include confirmation indicating the actual recipient.
Deadlines:
- 120 calendar days, as banks state, counted from the transaction date or from the day the service was to be performed. For deposits, this is very important: if you paid in March for a stay in August, the countdown starts in August. Check the exact wording in your bank's complaint regulations.
- The seller has 30 days (Visa) or 45 days (Mastercard) to respond.
The basis for the complaint regarding a failed accommodation is non-performance of the service. The bank selects the reason code, so do not look for a number, just describe the facts. Attach transaction confirmation, correspondence with the seller (as proof of an attempt to resolve the matter amicably), and evidence that the service was not performed.
Report of a Crime That Leads to Action
Fraudulently obtaining a deposit for non-existent accommodation is fraud under Article 286 § 1 of the Penal Code: anyone who, in order to gain financial benefits, leads another person to an unfavorable disposition of property by misleading them, is subject to imprisonment for 6 months to 8 years. In the case of lesser importance (§ 3), a fine, restriction of liberty, or imprisonment for up to 2 years is threatened.
If the perpetrator interfered with the IT system (took over the property's account on the platform, set up a payment gateway), Article 287 § 1 of the Penal Code (computer fraud) also applies, punishable by 3 months to 5 years.
The amount does not matter; it is always a crime
There is a belief that below 800 PLN it is “only a misdemeanor.” The threshold of 800 PLN separates a misdemeanor from a crime in theft and misappropriation, not in fraud. Article 286 of the Penal Code is not a halved act. A fraudulently obtained deposit of 200 PLN is still a crime, and the police are obliged to accept the report.
Where to file. A report will be accepted by any police unit or prosecutor's office, and if it is not locally competent, it will forward it. The service gov.pl/web/gov/zglos-przestepstwo confirms three channels: in person, remotely (by mail, email, or fax), and anonymously. It is free of charge.
What does not exist. There is no nationwide online form for submitting a crime report with procedural force. incydent.cert.pl and the “Safe Online” service in mObywatel are reports to CERT Polska. They are useful, but do not replace the report. The Central Bureau of Cybercrime's website is informational, not a form.
Template for the Report
[City], [date]
[Name and Surname]
[correspondence address]
[phone] · [email]
District Prosecutor's Office in [city]
or: City / County Police Headquarters in [city]
REPORT OF SUSPICION OF COMMITTING A CRIME
Based on Article 304 § 1 of the Code of Criminal Procedure, I report the suspicion of committing fraud under Article 286 § 1 of the Penal Code, committed to my detriment, and request the initiation and conduct of preparatory proceedings and prosecution of the perpetrator.
Factual state. On [date], an advertisement for renting [description of the property] appeared on the portal [name, full URL of the advertisement] at the address [address indicated in the advertisement], posted by a user using the data [nickname, name and surname, phone, email]. On [dates], I conducted correspondence with this person via [portal chat / WhatsApp / email], during which they assured me of the availability of the property on [date] and demanded a deposit payment of [amount] PLN for the reservation.
On [date], I made a transfer of [amount] PLN from account [sender's account number] to account [full recipient's account number] held at [bank name], indicated as belonging to [recipient's name from the transfer confirmation], with the title “[transfer title].”
After the payment was credited, contact ceased / [description]. The advertisement was removed on [date]. The property at the indicated address [does not exist / was not offered for rent, which I established by ...].
Justification. The perpetrator's behavior exhausts the features of Article 286 § 1 of the Penal Code: acting for the purpose of obtaining financial benefits, they led me to an unfavorable disposition of property in the amount of [amount] PLN, misleading me about the existence and availability of the offered property and about the intention to perform the contract.
Evidence requests. I request the admission and conduct of evidence from:
1. prints of the advertisement (attachment no. 1);
2. correspondence with the perpetrator (attachment no. 2);
3. transfer confirmation (attachment no. 3);
4. information from [bank name] about the account holder's data for account number [number] and the transaction history for that account under Article 105 of the Banking Law;
5. data of the subscriber of number [phone number] and data of the user of account [nickname] on the [portal] service, by requesting the operator and administrator of the service;
6. my hearing as a witness.
I also request, based on Article 46 § 1 of the Penal Code in conjunction with Article 49a of the Code of Criminal Procedure, that the perpetrator be ordered to compensate for the damage in the amount of [amount] PLN.
Please notify me of the initiation or refusal to initiate proceedings (Article 305 § 4 of the Code of Criminal Procedure).
[signature]
Attachments: 1–3
The request under Article 46 § 1 of the Penal Code is the most important sentence in the entire document. In the event of a conviction, the court may order the obligation to compensate for the damage, but at the request of the injured party, it must. The request can be submitted until the closure of the court proceedings, but submitting it immediately secures the case. This is also the cheapest way to obtain an enforceable title, without court fees, unlike a civil lawsuit.
Formal requirements arise from Article 119 § 1 of the Code of Criminal Procedure: designation of the authority and the case, designation and address of the applicant along with phone number and email address, content of the request with justification, date, and signature.
How long it takes and what registered dismissal means
If the authority conducts verification activities, the decision to initiate or refuse should be made no later than 30 days from receiving the report (Article 307 § 1 of the Code of Criminal Procedure). The investigation should conclude within 2 months, with the possibility of extension by the prosecutor to 3 months and further in particularly justified cases (Article 325i § 1 of the Code of Criminal Procedure). In practice, cases of internet fraud take longer.
The most common outcome is registered dismissal under Article 325f of the Code of Criminal Procedure: if after at least five days of investigation the data do not provide grounds for identifying the perpetrator, the case is dismissed and entered into the crime register. The police still conduct activities to detect the perpetrator (§ 2), and upon revealing data allowing identification, the investigation is resumed (§ 3). Dismissal does not mean that no crime occurred, only that the perpetrator was not identified.
What can be done:
- Appeal against dismissal or refusal to initiate (Article 306 of the Code of Criminal Procedure), within 7 days of receiving the decision. You also have the right to review the files.
- Appeal to the superior prosecutor, if you have not received information about the initiation or refusal within 6 weeks (Article 306 § 3 of the Code of Criminal Procedure).
- In the appeal, indicate specific, unperformed actions: inquiry to the bank about the account holder and transaction history, to the operator about subscriber data, to the portal about the IP address and registration data of the account. Dismissals often occur simply because no such inquiries were sent.
Civil Lawsuit Makes Sense Only After Identifying the Perpetrator
The claim for the return of the deposit is based on provisions regarding undue performance or tort. The limitation period is favorable: generally 3 years from the day you learned about the damage and the person liable, but if the damage resulted from a crime, 20 years from the commission of the crime, regardless of when you learned the perpetrator's identity (Article 442¹ § 2 of the Civil Code). Fraud under Article 286 § 1 of the Penal Code is a crime, so the claim will survive even if the perpetrator is identified eight years later.
Electronic payment order is conducted by the VI Civil Division of the District Court Lublin-West in Lublin through the portal e-sad.gov.pl (not through ePUAP, as documents sent this way do not have legal effects). The fee is one-fourth of the regular fee, not less than 30 PLN: for a claim of 2000 PLN, the regular fee is 200 PLN, so in the e-court, you will pay 50 PLN.
A barrier you should know about right away
A lawsuit in electronic payment order must include the PESEL number or NIP of the defendant. The victim of a rental scam does not know it, and the bank will not provide it, as banking secrecy applies (Article 105 of the Banking Law allows disclosure of data to the court and prosecutor in ongoing proceedings, not to private individuals). The civil route opens only when the identity is established by criminal proceedings or when the “landlord” is an existing, identified company.
A cheaper and more effective alternative is the request under Article 46 § 1 of the Penal Code in the criminal case: no court fee, and a judgment with the obligation to compensate for the damage is an enforceable title.
There is also a path that costs nothing. Articles 143a and 143b of the Payment Services Act describe the procedure for recovering funds: the bank must notify the recipient of the report within 3 business days and about the possibility of a free return, and if within 30 days the amount does not return, upon written request of the payer within 3 business days it provides the name or company name of the recipient and their address. However, the provisions concern providing an incorrect account number, so in the case of fraud, banks can refuse. A written refusal will be useful to the Financial Ombudsman.
Where Else to Report
| Where | Purpose | Conditions and Notes |
|---|---|---|
| incydent.cert.pl | Report a fake site and phishing | No registration required. The domain goes on the Warning List, blocked by Orange, Plus, Play, and T-Mobile. This is the fastest way to take down the site |
| SMS to number 8080 | Forward a suspicious SMS | Free of charge, using the “forward” function |
| mObywatel, “Safe Online” service | Report from the phone | Analyzed by CERT Polska, possible anonymously. Does not replace a crime report |
| OLX | Advertisement, profile, and messages | Report each of the three elements separately. OLX forwards data to the police upon written request |
| Facebook Marketplace and groups | Offer, profile, and in groups also the administrator | Report the offer as fraud plus a separate report of the profile |
| Airbnb, AirCover for guests | Cancellation by the host, lack of access to the property, significant discrepancies with the advertisement | 72 hours from detecting the problem, photos or videos needed. Payments outside the platform are not covered, and this is exactly the gap targeted by the “transfer to avoid commission” proposal |
| Booking.com | Report a compromised property account and a fake message | Through the Help Center after logging in. We did not find a compensation program for payments made outside the platform |
| Consumer Ombudsman (district or municipal) | Free advice, assistance with documents, and even filing a lawsuit on behalf of the consumer | Competent according to your place of residence. The best free representative available |
| Consumer Hotline | Telephone advice | 801 440 220 or 222 66 76 76, on business days |
| Financial Ombudsman | If the bank rejected the complaint | Intervention is free; amicable proceedings cost 50 PLN. Condition: exhausting the complaint procedure at the bank |
| Bank Consumer Arbitration at ZBP | Dispute with the bank up to 15,000 PLN | Fee 50 PLN. Document of complaint closure or statement that the bank did not respond within 30 days is needed. The ruling binds the bank |
| UOKiK | Only practices violating collective consumer interests | The office does not resolve individual cases and does not consider anonymous reports |
| European Consumer Centre | Cross-border disputes in the EU | konsument.gov.pl, tel. 22 55 60 600 |
The KNF public warning list only concerns the financial market, so you do not report rental fraud there. There is no public register of “scammer accounts” in Poland.
ID Scan in the Hands of the Scammer
If during the “reservation verification” you sent a photo of your ID or provided a complete set of data, the matter ceases to concern just the deposit. Activate two separate mechanisms.
Block your PESEL number. Free and immediately through gov.pl/web/gov/zastrzez-swoj-numer-pesel-lub-cofnij-zastrzezenie or at any municipal office. Log in with a trusted profile, e-ID, qualified signature, or through online banking. From June 1, 2024, financial institutions will be required to check the register before granting a loan or credit and before changing a contract that increases debt.
The legal effect is strong: if an institution grants a loan despite the blocking, it cannot effectively pursue a claim against you, your legal successors, or sell such a receivable to a debt collection company.
Blocking prevents, among other things, credit and loans, notarial transfer of property ownership, and issuance of a duplicate SIM card. It does not block registration with a doctor, prescription fulfillment, ATM withdrawals, transfers, traveling abroad, or handling administrative matters. The blocking can be revoked at any time, including with automatic reactivation at a specified time.
The Document Blocking System of the Polish Bank Association is a separate mechanism concerning a specific document, not a number. Report: at the bank, by phone at +48 828 828 828, or through the mObywatel app. The information reaches banks, telecommunications operators, and thousands of companies almost immediately.
Check if someone has already tried. You can download a free copy of your data from BIK once every six months based on Article 15 of the GDPR. You are interested in the sections “credit inquiries” and “active obligations”: an unrecognized loan after an unknown inquiry indicates fraud. The free service gov.pl/web/gov/sprawdz-kto-weryfikowal-czy-masz-zastrzezony-numer-pesel shows who and when checked the status of your PESEL. This is the fastest signal that someone is acting on your data.
Polonia: Booking and Reporting from Abroad
When booking accommodation in Poland from Chicago, London, or Berlin, you won't go to see the property or ask a neighbor, and if you lose money, the legal path runs in the country where you are not present.
You can file a report from abroad, by mail, email, or fax, to any police unit or prosecutor's office. The catch: an email without a signature is treated as anonymous. The authority may initiate proceedings ex officio, but you will not obtain procedural status or information about the outcome, so you will lose the right to appeal. Send a signed original by registered mail and simultaneously a PDF scan by email to get the case moving immediately. Keep the proof of mailing.
The consul will not accept a crime report. However, they can certify the authenticity of your signature, e.g., on a power of attorney, with the same effect as a notary (in person at the consulate).
The only representatives in criminal matters can be lawyers or legal advisors (Article 88 § 1 of the Code of Criminal Procedure). A relative or friend in Poland is not sufficient.
Chargeback from a foreign bank works differently in each country:
- USA. Regulation E protects against unauthorized transfers, and a transfer you initiated, being deceived, is generally not covered. The real route is credit card: a dispute over “goods not delivered as agreed” under the Fair Credit Billing Act must be reported in writing within 60 days of receiving the statement.
- United Kingdom. Section 75 of the Consumer Credit Act 1974 makes the credit card issuer jointly liable for misleading and non-performance of the contract, but only if the price exceeds 100 pounds and does not exceed 30,000 pounds. Mandatory refunds for APP frauds, introduced on October 7, 2024, do not cover international payments, so a transfer from a UK bank to a Polish one for accommodation will most likely not fall under it.
- Germany. No equivalent of Section 75. With a transfer, there is an attempt to reverse (Rückholung), dependent on the cooperation of the recipient's bank.
EU procedures, i.e., European Small Claims Procedure (up to 5000 euros) and European Payment Order, require an identified defendant with an address, which is what the victim lacks. They concern victims from the EU, not from the USA or the UK.
Advice for those booking from abroad: pay with a credit card and book through the official platform system. Only these two things work realistically at a distance.
Realistic Chances of Recovering Money
There are no hard data on accommodation fraud in Poland: neither the police nor CERT Polska distinguish such a category. The closest point of reference is “legend” frauds, such as the grandchild or police scams. In 2025, the losses of victims amounted to 158.7 million PLN, and the value of recovered property was less than 5 million PLN, which is about 3%. The previous year was similar.
The banking route is faster, but in a typical rental scam, i.e., a voluntarily executed transfer, the statutory refund does not apply.
The biggest difference is the zero hour. Blocking the recipient's account before the funds disappear is the only moment when the statistics are on your side. Therefore, the first call goes to the bank, not the police.
Related Materials
- Bank and Internet Fraud in Poland: Phishing, Spoofing, Fake BLIK, and How to Recover Money: broader context of banking procedures.
- How to Block Your PESEL Number Step by Step: when a scan of your ID lands in unauthorized hands.
- Fake Online Store: How to Recognize It and How to Recover Money: the same chargeback mechanics in a different context.
- Grandchild and Police Scams: how to remotely protect parents in Poland.
Frequently Asked Questions
I paid a deposit, but the accommodation is not for three months. Should I wait?
No. If contact has ceased, the number does not respond, or the advertisement has disappeared, act immediately. By the date of stay, the money will have long left the recipient's account. Chargeback with a card also counts from the day the service was to be performed, so the complaint remains possible later. Blocking the funds does not.
I paid 300 PLN. Will the police even accept it?
Yes, and they are obliged to: fraud is a crime regardless of the amount (details in the reporting section). Your report may also be combined with others into one case.
I live in the USA and am booking accommodation in Poland for family. What should I do differently?
Pay with a credit card, not an international transfer. Book through the official platform system, never “directly for a discount.” And ask someone from your family in Poland to call the number from the property's page, not from the advertisement, and confirm the reservation by voice.
The bank rejected my complaint because I initiated the transfer myself. What next?
After exhausting the complaint procedure, you can turn to the Financial Ombudsman (intervention is free) or, for disputes up to 15,000 PLN, to the Bank Consumer Arbitration at ZBP (fee 50 PLN). If it was the scammer who executed the operation with your stolen data, describe this in the appeal: authentication is not the same as authorization.
The police dismissed the case because the perpetrator was not identified. Is that the end?
No. Registered dismissal means that the perpetrator has not been detected yet, and the police are still conducting activities. You can appeal the decision within 7 days of receiving it. In the appeal, indicate specific actions that were not performed, e.g., an inquiry to the bank about the account holder.
Sources
Status as of October 23, 2026. This material is for informational purposes only and does not constitute legal or financial advice. Regulations, banking procedures, and platform regulations change, so check current conditions at the source before making a decision. For individual matters, seek free assistance from the district or municipal consumer ombudsman or legal advice.
Comments (0)
No comments yet. Be the first!