- Order matters: first call your bank or card issuer, then report the incident, then go to the police. Do not delete anything and take screenshots before the site disappears.
- If you paid by card, directly ask the bank for a chargeback and inquire about the deadline. Chargeback is handled by the bank that issued the card, not Visa or Mastercard, and there is no single deadline for everyone.
- Regular transfers and BLIK to a phone number are practically irreversible. Only time matters, meaning whether the bank can block the funds at the recipient's end.
- Only Poland: a transfer you initiated is an authorized transaction. Do not report it as unauthorized, as this could lead to criminal liability.
- Only USA: with a credit card, non-delivery is a "billing error" with 60 days to submit a written report from the date of the statement. A debit card does not provide such protection.
- Reporting: in Poland incident.cert.pl, SMS to 8080, and the police; in the USA reportfraud.ftc.gov and ic3.gov. "Help in recovering money" from comments is another scam.
- Part 1: How to Recognize a Fake Store and Check the Seller
- Part 2: What to Do After Payment, Chargeback, Bank, and Where to Report Fraud (you are reading now)
- Part 3: Buyer Rights in Poland and the USA, Customs, and Purchases by the Polish Diaspora
This part of the series is for those who have already paid and suspect they have encountered a fake store. How to recognize such a store before making a purchase is described in Part 1. Buyer rights against a legitimate seller and customs on packages between Poland and the USA are described in Part 3.
The rules for shopping, buyer rights, and reporting methods are completely different in Poland and the USA. Sections pertaining to only one country are clearly marked.
What to Do Immediately
Order matters: CERT Polska recommends starting with the bank, then reporting the incident, then going to the police.
First 15 Minutes
- Call your bank or card issuer. The number is on the back of your card and in the app. Clearly state: "I have fallen victim to an online shopping scam, please block the transaction and initiate a complaint." If you paid by card, directly ask for a chargeback.
- If you provided login details or an SMS code – block access to banking and change your password from another trusted device. This is no longer a purchase issue, but a matter of your account.
- Do not delete anything and take screenshots: offer, cart, payment page, address in the browser bar, correspondence, confirmation of transfer with the recipient's account number.
First Hour
- Save evidence in one place: one folder, one file with a timeline. This will be needed by the bank and the police.
- Check if additional amounts are being deducted from your account. If so, this is no longer a failed purchase, but a data breach.
- Only Poland: report the domain to CERT Polska via incident.cert.pl – this blocks the site for others. Forward any suspicious SMS to the free number 8080, in full and without shortening.
- Only USA: report the case at reportfraud.ftc.gov and ic3.gov.
First Day
- File a report with the police. Only Poland: at any police station or prosecutor's office. Only USA: at the local police plus a report to IC3.
- Only Poland: if you provided the scammer with your PESEL number or ID details, block your PESEL. This will not recover your money, but will make it harder to take out a loan in your name.
- Warn others: report the advertisement to the platform where you saw it.
We do not promise that the money will be returned. The chances are highest with card payments and quick reactions; with regular transfers and BLIK to a phone number, they are minimal.
Payment Methods and Real Protection
How you paid determines whether you have any tools in case of trouble. The table shows what you can expect with each method.
| Method | What Protection | How to Recover | Risk |
|---|---|---|---|
| Credit Card | Strongest. Only USA: non-delivery is a "billing error" under the Fair Credit Billing Act – with no monetary threshold. Only Poland: protection comes from Visa/Mastercard rules, not from the law. | Complaint to the issuing bank plus a chargeback request. | Lowest. In the USA, for a transaction without a physical card, the liability for unauthorized use is $0. |
| Debit Card | Weaker. Only USA: Regulation E covers unauthorized transactions, but does not recognize the category "item not delivered". | Complaint to the bank and chargeback according to card organization rules. | Money is deducted from the account immediately, not from a credit limit. |
| PayPal | Buyer Protection: "I did not receive the item" and "item significantly not as described". | Dispute in the Resolution Center, then escalate to a claim within 20 days. | Short and varying deadlines: non-delivery – 180 days from payment; not as described – 30 days from delivery or 180 days from payment, whichever comes first. You cannot dispute in PayPal and the bank simultaneously. |
| Cash on Delivery | You see the package before payment, but usually not its contents. | Refusal to accept the shipment. | Does not protect against an empty box or a brick; the courier is not obliged to wait for unpacking. |
| Regular Bank Transfer | Practically none. | Report to the bank and police hoping to block the funds before they leave the recipient's account. | Very high. This is a transaction authorized by you, so the bank has no legal obligation to return it. |
| BLIK to Phone Number | None. | As above; only time matters. | Very high and immediate. Money reaches the recipient in seconds. |
| Cryptocurrency, Gift Cards, Money Transfers | None. | No real way; with a transfer, only contact with the operator matters before it is picked up. | FTC states that cryptocurrency payments are usually irreversible, and requesting any of these methods is a signal of fraud. |
When shopping at an unknown store, pay by card (preferably credit card) or through PayPal. Not because the store is definitely scamming, but because these methods provide a way back that a transfer does not. And if the only method is a transfer or BLIK to a phone number, treat it as information about the store, not about the technology.
Chargeback: What It Is and Who Handles It
Chargeback is a reversal procedure: the bank that issued your card reverses the payment and tries to recover the money from the seller's bank. This tool comes from the rules of Visa and Mastercard, meaning from agreements between banks – not from the law.
A complaint is a conversation with the seller; chargeback is a conversation with your bank about the card transaction. With a fake store, a complaint is pointless because there is no one to talk to, and then chargeback may be the only way. It is always handled by the bank that issued your card – neither Visa nor Mastercard accept reports from consumers; Visa states unequivocally: "Visa does not initiate, manage, or have access to cardholder or merchant accounts."
There is no single, universal deadline for chargeback. Deadlines arise from card organization rules, which are not published in full and may change. The only fair advice is: ask your bank immediately what your deadline is, and do not delay.
Only USA: alongside chargeback, you have statutory rights against the credit card issuer – non-delivery is a "billing error" with strict deadlines for the bank. We describe them below in the section on cards in the USA.
Only Poland: Polish law does not regulate chargeback and does not set a deadline. UOKiK recommends informing the bank, "especially if we paid by card," and indicates chargeback as a chance, not a guarantee, for recovering money.
Chargeback does not work with regular transfers, BLIK to a phone number, cryptocurrency, or gift cards. This tool is exclusively for card transactions.
Transfer to a Fake Store and Complaint to the Bank in Poland
Only Poland.
The Payment Services Act provides strong protection for unauthorized transactions. Article 46, paragraph 1 imposes an obligation on the provider to refund the amount "immediately, but no later than by the end of the business day following the day of determining the occurrence of an unauthorized transaction (...) or after the day of receiving the appropriate report." The only exception: when the provider has justified and duly documented grounds to suspect fraud and informs the relevant authorities in writing. The burden of proof that the transaction was authorized rests with the provider (Article 45), and the report must be submitted within 13 months from the account charge (Article 44, paragraph 2).
However: a transaction is considered authorized if the payer consented to it in the manner provided for in the agreement (Article 40, paragraph 1). If you initiated a transfer to a fake store, the transaction was authorized – even if you were deceived about who the recipient is. The regime under Article 46, paragraph 1 is built around the lack of consent, and official materials illustrate it only with cases of data breaches by a third party. UOKiK, describing fake stores, directs victims to the bank, CERT Polska, and the police, not to Article 46.
Do not report a knowingly executed transfer as an unauthorized transaction. The joint material of the Financial Ombudsman and UOKiK warns that such action may be treated as an attempt at fraud and carries criminal liability. Report what actually happened and ask for a chargeback if you paid by card. It is different if you provided login details on a counterfeit site and the scammer executed the transfer – then you are under the regime of unauthorized transactions, and the above provisions work in your favor.
Credit Card and Debit Card in the USA
Only USA. Alongside chargeback, federal law gives cardholders their own rights, but credit and debit cards are two different worlds.
Credit Card (Fair Credit Billing Act). An item that did not arrive or is not as described is a "billing error" (12 CFR 1026.13(a)(3)): 60 days to submit a written report from the date of the statement, 30 days for the bank to confirm, two billing cycles (maximum 90 days) for resolution, and no obligation to pay the disputed amount in the meantime. The regulation does not require you to first contact the seller. In cases of unauthorized use of the card, liability is limited to $50, and if the card itself was not presented (which is the case in every typical online purchase), there is no liability at all.
There is also the "claims and defenses" right, subject to conditions: prior attempt to resolve the dispute with the seller, amount over $50, and the transaction in the same state or within 100 miles of the cardholder's address. Federal regulations do not determine where an online purchase "occurs" – the commentary to Regulation Z refers to state law. Therefore, with a fake store, the simpler route is billing error.
Debit Card and Transfers (Regulation E). Protects against unauthorized electronic transfers: $50 liability if reported within two business days of learning of loss or theft, $500 liability for later reporting, and after 60 days from the statement, liability is not limited in amount. The bank generally has 10 business days to determine if an error occurred; the deadline extends if it provides a temporary credit to the account.
Two limitations. First, the list of "errors" in Regulation E does not include the category "item not delivered" – the FTC states outright that protection for debit cards is different, and you may not recover money for non-delivery. Second, a transfer you initiated to a scammer is not an unauthorized transfer, as the definition refers to a transfer initiated by someone other than the consumer; the CFPB confirms, however, that a transfer made by a scammer using stolen login data is protected. Wire transfers are excluded from Regulation E.
Where to Report Fraud or Incident
Only Poland
| Where | For What | How |
|---|---|---|
| Your Bank | Complaint, chargeback, blocking funds | Number from the back of the card; first step |
| CERT Polska | Blocking the fake domain for others | incident.cert.pl; suspicious SMS in full to the free number 8080 |
| The Police | Report of a crime under Article 286 of the Penal Code | In person at any police station or prosecutor's office, or in writing. There is no official e-form. |
| Consumer Helpline | Free legal advice | 801 440 220 or 22 266 76 76, weekdays 10:00–18:00 |
| Consumer Ombudsman | Free assistance in individual cases, including writing letters | prawakonsumenta.uokik.gov.pl |
| Financial Ombudsman | Dispute with the bank after a rejected complaint | bip.rf.gov.pl, biuro@rf.gov.pl, tel. 22 333 73 26 |
| UOKiK | Practices violating collective consumer interests | In writing to the Office; UOKiK does not consider individual cases or anonymous reports |
| ECK | Dispute with a seller operating in the EU, Iceland, or Norway | ECCNET-PL@ec.europa.eu, tel. 22 55 60 600, 10:00–13:00. Does not deal with fraud. |
| Polish Post | Impersonation of the Post | incydent@poczta-polska.pl |
The order recommended by CERT Polska: first the bank, then report the incident, then the police. Prepare the store's website address, correspondence in its original form, the recipient's account number, transfer confirmations, and information on what and when you lost – this is the list requested by CBZC.
Only USA
| Where | For What | How |
|---|---|---|
| Your Bank or Card Issuer | Billing error and chargeback | Number from the back of the card; for credit card, written notice within 60 days from the statement |
| FTC | Central fraud report | reportfraud.ftc.gov. Reports feed a database for law enforcement – this is not a money recovery procedure. |
| FBI IC3 | Report of internet crime | ic3.gov, form complaint.ic3.gov. IC3 notes: "You will not hear from the IC3." Accepts reports from outside the USA as well. |
| USPIS | When the U.S. Postal Service was used in the fraud | uspis.gov/report, tel. 1-877-876-2455; emails to spam@uspis.gov, SMS to 7726 |
| State | Complaint against the seller and company practices | usa.gov/state-consumer and usa.gov/state-attorney-general |
| BBB Scam Tracker | Warning others | bbb.org/scamtracker |
| econsumer.gov | Purchase from a seller outside the USA | econsumer.gov |
Reporting an Advertisement and Listing to the Platform
Do this regardless of the official report. This is the only way to stop the advertisement from being displayed to others. The "Report" buttons (OLX, Vinted) and "Report Violation" (Allegro) are next to the listing; phishing to phishing@vinted.com and phishing@allegro.pl. On Facebook and Instagram, report the listing or profile separately and the advertisement separately.
Common Mistakes
Waiting "a few more days" to avoid making a fuss. With chargeback and blocking funds, a day counts, not a week.
Deleting evidence. The bank and police will specifically ask for what you just deleted.
Paying "a second time to unlock the first payment." Classic victim re-victimization: "the transfer did not go through, please pay an additional 30 PLN, we will refund it with the order." Never pay extra for a lost payment.
Providing the SMS code on the store's website. The code from the bank authorizes the operation on your account. It is not for "confirming identity" with the seller.
Reporting your own, knowingly executed transfer as an unauthorized transaction. Only Poland: The Financial Ombudsman and UOKiK warn that this may be treated as an attempt at fraud. Describe what actually happened.
Accepting offers of "help in recovering money" from comments. People commenting on scam posts are almost always further scammers. IC3 explicitly states that it does not cooperate with any entities other than law enforcement in recovering funds and never contacts victims for money.
Assuming the amount is too small to report. Only Poland: Polish law does not recognize fraud as a misdemeanor. Fraud under Article 286 § 1 of the Penal Code is a crime regardless of the amount and is prosecuted ex officio. Your report may be the one that connects cases into one proceeding.
Myths and Facts
Myth: The bank will always return my money. Fact: Not always. The statutory obligation for quick refunds in Poland applies to unauthorized transactions, and a transfer you initiated is an authorized transaction. With a card, there is chargeback – a real chance, but not a guarantee.
Key Principles
- Pay by card, not by transfer. This is the only decision before the purchase that truly changes your situation after a scam.
- Never provide the SMS code from the bank on the store's website.
- After a loss, call the bank first, then report the incident, then go to the police.
- Do not delete anything and take screenshots before the site disappears.
- Do not pay extra for a lost payment. A request for "a small additional payment" after a failed transfer is from the same person.
Checklist
After Payment, Before the Goods Arrive
- I saved the order confirmation and payment confirmation.
- I took a screenshot of the product page with the price and declared shipping time.
- I saved the website address and seller details provided at the time of the order.
- I know the declared shipping date.
When I Suspect Fraud
- I called the bank and requested a complaint, and for the card, a chargeback.
- I asked the bank about the deadline for submitting a chargeback.
- I took screenshots of everything before the site disappeared.
- I did not delete anything.
- I did not pay any additional amount.
- Only Poland: I reported the domain at incident.cert.pl, and the SMS to 8080.
- Only Poland: I filed a report with the police.
- Only Poland: if I provided ID details, I blocked my PESEL.
- Only USA: I reported at reportfraud.ftc.gov and ic3.gov.
- Only USA: I reported to my state consumer protection office.
- I reported the listing and advertisement to the platform where I saw it.
- If I provided login details or an SMS code – I changed my password and blocked access.
- I checked if additional amounts are being deducted from my account.
Frequently Asked Questions
Does the bank have to return the money I transferred to a fake store?
There is no such obligation, and no honest person will give you a guarantee here. Only Poland: The statutory obligation for quick refunds under Article 46, paragraph 1 of the Payment Services Act applies to unauthorized transactions, meaning those you did not consent to. A transfer you initiated is an authorized transaction, even if you were deceived about the recipient. If, however, the scammer executed the transfer after obtaining your login details, you are under the regime of unauthorized transactions, and the provisions work in your favor.
What is the deadline for submitting a chargeback?
There is no single, universal deadline because chargeback arises from the rules of Visa and Mastercard, not from the law. These rules are not published in full and may change. Therefore, ask your bank about the deadline during your first call and do not delay the complaint. Only USA: regardless of chargeback, you have statutory rights under the Fair Credit Billing Act – a written report must reach the card issuer within 60 days from the statement with the disputed transaction.
What is the difference between chargeback and a complaint to the seller?
A complaint is a conversation with the seller about defective or undelivered goods. Chargeback is a conversation with the bank that issued your card about reversing the payment. With a legitimate store, you start with a complaint. With a fake store, a complaint is pointless because there is no one to talk to, and chargeback may be the only way.
Can a BLIK to a phone number be reversed?
In practice, no. Money reaches the recipient in seconds, and you authorized the transfer yourself. The only thing that makes sense is an immediate call to the bank before the funds leave the recipient's account, and reporting to the police. Therefore, when purchasing from an unknown seller, BLIK to a phone number is the worst possible choice.
Is it worth reporting fraud for a small amount?
Yes. Only Poland: In Polish law, there is no misdemeanor of fraud – Article 286 § 1 of the Penal Code applies regardless of the amount and is prosecuted ex officio. Your report may be the one that allows many small cases to be combined into one proceeding. Report the domain to CERT Polska separately – this blocks the site for subsequent individuals, even if you do not recover your money.
Someone is offering me help in recovering lost money in the comments. Should I take it?
No. This is almost always another stage of the scam, known as secondary fraud. IC3 explicitly states that it does not cooperate with any entities other than law enforcement in recovering funds and that it never contacts victims for information or money. Only your bank and law enforcement deal with recovery, and none of these institutions charge an advance fee.
Sources
As of October 23, 2026. This guide is for informational purposes only and does not constitute legal or financial advice. It does not guarantee recovery of funds: neither chargeback nor complaint to the bank provides certainty of return. Customs regulations, deadlines, and platform rules change frequently, so check the current page of the relevant institution before acting. For individual matters, contact your bank, the consumer ombudsman (Poland), your state consumer protection office (USA), or a lawyer.
Comments (0)
No comments yet. Be the first!