Banking and Internet Fraud in Poland: Phishing, Spoofing, Fake BLIK, and How to Recover Your Money (2026)

In 2025, CERT Polska handled 253,238 incidents classified as computer fraud. This is a 158% increase compared to the previous year and 97% of all reports the team dealt with. In the same year, over 244,000 dangerous domains were added to CERT's warning list, and operators blocked nearly 1.9 million malicious SMS messages. If you have an account with a Polish bank or assist family in Poland, it is important to be aware of current fraud schemes. Even more crucial are your rights: in the case of an unauthorized transaction, the bank is obliged to refund your money by the end of the next business day at the latest, and it must prove that you authorized the payment. Below, we describe current scams, free protection tools, and the path to recovering your money, even if you live abroad.

How Fraudsters Lure Victims (CERT Polska Data for 2025)

• Fake Investments. CERT calls them one of the most financially damaging threats. Fraudsters create websites with alleged investment platforms, impersonate well-known fuel and energy companies, and use images of public figures. In 2025, 98,663 such domains were added to the warning list. We discuss safe saving in our guide on bonds and saving.
• Phishing, or Credential Theft. CERT recorded 78,391 such incidents. Most often, fraudsters impersonated the two largest Polish advertising and sales platforms: the “buyer” sends a link to “collect money,” and the site steals card data.
• Fake Payment Requests and Refunds. Websites pretending to be the e-TOLL system with “overdue road fees,” “refund from NFZ” for medications, “overpayment for electricity.” The form usually has two stages: first personal data, then card details.
• SMS Without a Link. Blocking SMS messages with links works, so criminals increasingly send messages that only encourage contact, for example, “Mom, my phone broke, write on the messenger.”
• BLIK. A compromised friend's social media account asks for a BLIK code, “because they urgently need it.” In April 2025, CERT also warned about a campaign impersonating the BLIK service itself.
• Fake Applications. Following reports, CERT removed 119 applications impersonating well-known Polish companies from the official Android app store. Only install the official app of your bank and check the publisher.
• Phone “from the bank” with a Spoofed Number. Since 2023, impersonating someone else's number to commit fraud is a crime punishable by 3 months to 5 years in prison (art. 31 of the Act on Combating Abuse in Electronic Communication), and operators must block such calls or hide the fake number. However, this phenomenon has not disappeared, so treat every phone call “from the bank” as potentially fraudulent. Schemes targeting seniors, such as “grandchild scam” or “safe account,” are described in our guide on protecting parents from fraudsters.

Will the Bank Refund Your Money?

It largely depends on who initiated the payment. The scheme will help determine your situation and what to start with.

Your Rights Under the Payment Services Act

UOKiK has been checking for years whether banks comply with these regulations. In July 2022, it charged five banks, and in February 2024, another six, precisely for not refunding money from unauthorized transactions on time. However, it must be said honestly: a transfer that you approved yourself under manipulation is a different situation than data theft. Here, banks defend themselves more effectively, and the chances of a refund are lower. As of October 23, 2026, Polish law does not contain a provision that would transfer responsibility for such a transfer to the bank after a phone call from a spoofed number. The new EU Payment Services Regulation (PSR), which is set to expand banks' liability for “bank employee” fraud, is not yet in effect.

Recovering Money Step by Step

Banking from Abroad: Daily Habits

• Log in only through the bank's official app with mobile authentication on a trusted phone. Before a long trip, update your phone number and contact details with the bank.
• Banks may additionally verify logins from foreign IP addresses. This is normal. Avoid logging in through public Wi-Fi.
• Never install remote desktop software “at the bank's request,” as this is a classic way to take over an account. The bank will never ask you to transfer to a “technical account” or “safe account.”
• If you are unsure whether a website or institution is genuine, check it using methods from the guide on recognizing genuine sources.

Frequently Asked Questions

How long does the bank have to refund money from an unauthorized transaction?

By the end of the business day following the day the bank discovered the transaction or received your report. The exception applies when the bank has documented grounds to suspect fraud and notifies law enforcement in writing.

I provided a BLIK code to a “friend” in a chat. Does the bank have to refund my money?

Probably not based on art. 46, because you provided the code yourself, meaning you authorized the transaction. Immediately report the matter to the bank, request an attempt to stop the funds, and file a report with the police. If the bank refuses, you can contact the Financial Ombudsman.

Can I file a crime report while living in the USA?

Yes. A report can be filed in writing and sent by mail to the prosecutor's office in Poland or assigned to an attorney. Include all evidence: payment confirmations, screenshots, account numbers.

Is the procedure before the Financial Ombudsman free of charge?

The intervention procedure is free. For the amicable procedure, the client pays 50 PLN, and the Ombudsman may waive this fee in particularly justified cases.

Sources

As of October 23, 2026. This guide is informational and does not constitute legal advice. For specific matters, contact your bank, the Financial Ombudsman, the police, or a lawyer.