Bank and Internet Fraud in Poland: Phishing, Spoofing, Fake BLIK, and How to Recover Your Money (2026)

A quarter of a million incidents of computer fraud in a year – that’s how many CERT Polska registered in 2025 (an increase of 158%), adding a quarter of a million domains to the warning list and blocking nearly 1.9 million malicious SMS messages with operators during that time. If you have a Polish bank account (or help family in Poland), you need to know today’s fraud schemes – and, more importantly, your hard rights: the bank has a statutory obligation to reimburse unauthorized transactions by the end of the next business day, and the burden of proof lies with it. This guide describes current scams, free defensive infrastructure (number 8080, CERT warning list, blocking), and a step-by-step path to recovering money – even remotely, from abroad.

What They Are Fishing For in 2025/2026 (CERT Polska Data)

• Fake investment sites – according to CERT, “the most financially damaging” scams: platforms impersonating Orlen or Baltic Pipe with images of well-known individuals (more in the guide on bonds and saving).
• Brand phishing: 78,000 incidents of login data theft in 2025 – most commonly impersonating OLX (28,000) and Allegro (22,000): “buyers” send a link to “collect money,” which steals card data.
• Fake payment requests: “e-TOLL” sites with overdue road fees, “refund from NFZ,” “overpayment for electricity” – two-step forms first extracting personal data, then the card with CVV code.
• SMS without a link (new trend): after successfully blocking SMS with links, criminals write “Mom, my phone broke, text me on WhatsApp…” – bait to contact outside SMS.
• BLIK: a friend’s compromised Facebook account asks for a BLIK code “because they urgently need it”; in 2025, CERT also warned of a campaign impersonating the BLIK service itself.
• Fake applications: 119 applications impersonating well-known Polish companies were removed from Google Play after CERT reports – only install official bank applications and check the publisher.
• Phone spoofing “from the bank”: still active despite the law – since 2023, impersonating a number is a crime (up to 5 years), operators block fake calls and registered SMS overlays, but approach every incoming call “from the bank” with the assumption that it may be fake. Scenarios targeting seniors (“for the grandchild,” “safe account”) are described separately in the guide on protecting parents from scammers.

Your Hard Rights: Payment Services Act

Context worth knowing: UOKiK has been pursuing banks for the practice of “we reject because the client was negligent” – it charged several banks in 2022 and 2024 for not returning funds from unauthorized transactions within the D+1 deadline. A fair note: there is a difference between an unauthorized transaction (someone stole the data) and a transfer that you authorized under manipulation – in the latter case, banks defend themselves more effectively and the chances of reimbursement are lower.

Step-by-Step Money Recovery

Banking from Abroad: Digital Hygiene

• Log in only through the official bank app with mobile authorization on a trusted phone – authorization apps work worldwide. Before a long trip, update your phone number and contact details with the bank.
• Some banks apply additional verifications when logging in from foreign IP addresses – this is normal; avoid logging in through public Wi-Fi and random VPNs.
• Never install software “at the bank's request” (AnyDesk and similar remote desktops are classic account takeover methods) and remember: the bank never asks for a transfer to a “technical account.”
• A cautionary tale: criminals even exploit bank rebranding – after the ownership change, Santander Bank Polska redirects addresses to the new brand, and every such confusion is a harvest for phishing. You can verify the authenticity of any financial site using methods from the guide on recognizing true sources.

Sources