If money is being taken now, end the suspicious conversation first and contact your bank independently from a safe device. Ask it to block compromised payment instruments and access, register the suspect transactions and try to stop the transfer. Keep the case number. Do not wait for a response from the police before telling the bank.
A scammer does not have to break into a bank's systems. Getting you to approve someone else's purchase, open a lookalike page or install remote-access software may be enough. Unfamiliar Polish terminology and fear of a “document check” can make this harder for foreign residents. Limited Polish does not remove your right to contact a bank or report a crime.
Checked 18.10.2026. Next scheduled review: 18.11.2026. This guide distinguishes different kinds of exposure, complaints and the limits of recovering money. It is practical guidance, not a promise that you will win a dispute. Opening and configuring an account is covered in the separate banking guide.
How scams work: a short glossary
| Term | What happens | Warning sign |
|---|---|---|
| Phishing | A fake page or message collects confidential information | A link asks you to log into banking outside your usual route |
| Smishing | Phishing delivered by SMS | A small delivery charge opens a card-details form |
| Vishing | A caller manipulates you over the phone | They ask for a payment, code or app installation |
| Spoofing | Displayed sender information is falsified | A bank name on screen is treated as proof of identity |
| Social engineering | Fear, urgency or trust is used to influence a decision | You are told not to hang up and check independently |
| Account takeover | An outsider gains control of a real profile | A friend suddenly asks for money only through messages |
A message's appearance proves little: a logo, fluent Polish, a familiar name and some genuine personal information can all appear in a forgery. Ask what action you are being asked to take and who benefits. Checking an urgent “threat” through an independent channel is safer than discussing details with an unknown caller.
Parcel, surcharge, tax-refund, fine, data-update and account-blocking messages often follow the same chain: anxiety → link → secrets → approval. Genuine organisations also send notifications, so check the underlying issue in an official service you open yourself. Do not pay a debt merely because the message looks plausible.
BLIK: sharing a code and approving a transaction are different events
A common scam starts with a friend messaging: “Lend me money urgently; my card isn't working.” An outsider may already control that genuine profile. You share a BLIK code, while the request in your banking app concerns the scammer's cash withdrawal or purchase. Check more than the amount: read the transaction type and information your bank actually displays. A purchase and an ATM withdrawal are different actions.
Do not approve a request to “cancel”, “refund” or test security. If you have already sent a code, reject unfamiliar requests, stop sharing codes and check your history. No debit at that instant is not a reason to keep talking: verify your friend's identity by calling a previously known number.
BLIK includes different services: code payments, transfers to a phone number, contactless transactions and other bank-supported functions. Warning signs for one cannot simply be applied to every other method. A genuine phone-number transfer is not the same as sending a code for someone else's ATM withdrawal. The official BLIK safety campaign explains how the purpose of a transaction can be misrepresented.
If you approved a payment, give the bank the exact sequence, not just “I was scammed through BLIK”. Who initiated it, what the screen said, what you agreed to and which information you shared matter to the investigation and legal assessment. Pressing a button does not replace an assessment of consent; equally, regretting a transfer does not automatically make it unauthorised.
Fake SMS: parcels, tax, fines and “updating your details”
A small amount is bait: you focus on paying a delivery surcharge and overlook the form asking for the card number, expiry date, security code and then a banking approval for a different action. Expecting a real parcel does not authenticate an SMS. Open the carrier's app yourself and check the tracking number from your own order.
For a tax message, access the official tax service in your normal way; for banking, open your installed app. Do not use a number supplied in the suspicious message. For a fine or enforcement demand, verify the authority and document using independent contact details rather than paying to “close the case” immediately.
Forward a suspicious SMS containing a link to 8080 using your phone's forwarding function. This is CERT Polska's current channel; the original text is more useful than a retyped account. Report links and other incidents through incydent.cert.pl. Do not reopen a malicious link just to take a screenshot. CERT's contact channels do not replace the bank for exposed payment details or the police for a suspected crime.
The September CERT Polska report provides current campaign context. It describes campaigns, not your individual probability of being targeted: message counts must not be turned into exact victim counts or a promise that filters will stop every SMS.
A call from “bank security”: a safe response
Warning signs include demands to move savings immediately to a “technical” or “safe” account, disclose codes, take out a loan for a check, withdraw cash, install software or hide events from branch staff. A fake staff ID or “police report” sent to you does not authenticate a call.
- Say you will end the conversation and contact the bank yourself. Do not discuss your balance.
- Actually disconnect. Do not remain on the line for an offered “transfer”.
- Open the app or find the official number on your own card or a bank website you opened independently.
- If your device may be remotely controlled, use another safe phone or visit a branch.
- Ask the bank to check access and transactions. Complete identity checks only in the channel you independently established.
There is no legitimate need to give an unknown caller control of your phone to protect an account. A real bank may block suspicious transactions and verify a customer; that is different from transferring money to an account dictated over the phone. The police specifically warn about forged documents and “safe accounts”.
OLX and other marketplaces: sellers should not pay to receive money
After you list an item, a “buyer” moves the conversation to a messenger, sends a confirmation and offers a link for collecting payment. The imitation displays your item and price, then asks for card details or a banking login. A photograph of your actual phone proves only that the listing is public.
Check orders and payouts in the marketplace account you open yourself. A transfer screenshot is not a credit to your account. Do not ship based only on an unknown sender's email. A courier supposedly already paid for is not a reason to disclose confidential information.
Legitimate payment operators may need to identify a seller. It would therefore be wrong to say a marketplace never checks information. Distinguish a documented procedure inside a verified service from a form supplied by a buyer. Consult OLX's warnings and its repeat-verification explanation. Do not send a passport to a “courier” without checking the recipient and purpose.
Fake websites, apps and investment offers
Start banking from a saved bookmark or installed app. A search advertisement does not establish an official connection. Check the full domain: a familiar brand embedded in a long address may sit on someone else's domain. An encrypted-connection symbol indicates encryption, not an honest website owner.
Do not install a banking “upgrade” from an attachment, chat or caller's instructions. Even a store app should be checked against the bank's official link and publisher. PKO Bank Polski explains how to verify an app and login page; the publisher and official route matter more than advertising. Requests for screen, SMS, accessibility or device-control permissions deserve special attention: they can let an outsider read approvals and interfere with actions.
An investment scam often begins with a celebrity advertisement, guaranteed returns and a small initial deposit. A consultant then displays growth on a fabricated balance, demands more money and requires a “tax” or “unlocking fee” before withdrawal. Dashboard figures do not prove assets exist. Do not borrow to continue the scheme.
Check organisations in official registers and KNF warnings, but absence from a warning list is not a licence. KNF describes the investment-scam chain. Losing money may trigger another attack: a “lawyer”, “regulator” or “blockchain specialist” promises recovery for an advance fee. The KNF warning dated 30.09.2026 concerns this recovery scam, including impersonation of supervisory officials.
Immediate action: seven different situations
| Situation | Act now | Also check |
|---|---|---|
| BLIK code shared, no approval | Reject unknown requests; do not provide another code | History, access and the other profile’s identity |
| Suspicious BLIK approved | Immediately tell the bank the type, time and amount | Other requests, ATM/purchase details and blocking needs |
| Ordinary transfer sent | Ask the bank urgently to try to stop or recall it | Status, recipient and account; recovery is not guaranteed |
| Card details exposed | Ask the bank to block the compromised card | Unknown payments and replacement needs |
| Bank password entered on a fake page | Contact the bank from a safe device and close outside access | Passwords, sessions, new devices and payees |
| Remote-access app installed | Disconnect the device; call from another phone | Apps and permissions granted |
| Phone compromised or connectivity lost | Bank from another device; operator if SIM takeover suspected | SIM, email, account recovery and device safety |
Blocking a card is not the same as blocking online banking. Changing a password does not guarantee that outside sessions end or a completed transfer is cancelled. Tell the bank exactly what is compromised: card, app, login, phone, SIM or email. Ask which instruments have been blocked and how to restore access safely.
Zastrzegam.pl: +48 828 828 828 routes callers to a participating bank to block a card. It does not automatically block the whole account or every card at different banks. Another bank requires another call; check participating banks. The service itself is free, but your operator may charge for the call under your tariff. Use your bank's verified direct channel when available.
Do not enter new passwords on a suspect device. First limit the attacker's access and arrange recovery with the bank. Keep the app's name, time, granted permissions and messages; do not delay blocking while assembling a perfect archive. Do not use the phone for banking before technical remediation. Deleting an app icon is not proof that the device is safe.
If identity documents were exposed, also assess identity misuse: keep details of the leak, contact the competent authorities and consider reserving your PESEL. This does not return a transfer or replace card blocking. For an ordinary fraud incident without immediate danger to life, do not use an emergency number instead of the bank's hotline.
Where to report and what evidence to keep
| Channel | Role | Not a promise of |
|---|---|---|
| Your bank/payment provider | Blocking, recording transactions, stopping attempts, complaints | Automatic reimbursement of every transfer |
| Policja or prosecutor | Crime report and investigation | Instant cancellation of a banking transaction |
| CERT Polska / NASK | Technical reports of phishing and harmful addresses | An individual ruling on lost money |
| Rzecznik Finansowy | Help after complaining to a financial institution | A criminal investigation or guaranteed victory |
| UOKiK | Protection of collective consumer interests | Recovery of your specific sum instead of a court |
| KNF | Financial supervision and warnings | A paid service to recover lost investments |
Keep the transaction statement, dates and times, recipient account, identifiers, fake-page address, messages, call history and acknowledgement from the bank. Export the conversation if possible rather than relying on cropped screenshots. Do not publish evidence openly: it may contain personal and banking information.
Prepare a timeline for the police: how contact began, what was promised, what you did, what transactions you discovered and when you told the bank. Ask for acknowledgement and a case reference if already assigned. Do not postpone the banking complaint until the investigation ends. Prepare a Polish description or translation for written communication, but do not invent circumstances to fit a supposedly “correct” formula.
Will the bank refund you? Consent, D+1 and complaints
The Payments Services Act distinguishes consent from technical authentication. Article 40 addresses authorisation; Article 45 places the burden of proof on the provider. A password or code record alone is insufficient to establish consent or gross negligence. However, a transfer you genuinely instructed to a particular recipient needs separate assessment even if a dishonest seller supplied the motive.
For an unauthorised transaction, Article 46 provides for an immediate refund, no later than the end of the next business day after discovery or notification: D+1. The statute includes an exception for justified, documented grounds to suspect fraud with written notification to law-enforcement authorities. This is not general permission to await the end of every investigation.
The initial refund and final liability are distinct. Intentional conduct and proven grossly negligent breaches of duties can affect liability. The statutory 50 EUR limit concerns specified loss, theft or misappropriation cases and has exceptions; it is not a universal deductible for every victim. Separate protection applies after proper notification, subject to intentional conduct.
Notify promptly. The 13-month limit in Article 44 is not advice to wait: there is an exception where the provider failed to supply required information, and delay reduces the chance of stopping funds. Under Article 15a, payment complaints normally receive a response within 15 business days; particularly complex cases may take up to 35 business days with reasons for delay. Neither is the D+1 deadline or a universal period for every banking complaint.
Keep the complaint and proof of receipt. If refused, ask for factual and legal reasons, not merely “confirmed by a code”. In September 2026, UOKiK reported changes to four banks' practices. This is a current reminder of the distinction, not proof of your own outcome.
After complaining, assistance from Rzecznik Finansowy may be available. Include the bank's answer and timeline. Significant losses, disputed consent or procedural deadlines call for individual legal assessment. Our unknown-debit guide complements this overview.
Reconstructing the transaction without losing evidence
After initial blocking, record each action separately. Do not merge the call, app login and debit into one entry: minutes may have passed and the purpose of an approval may have changed. Distinguish what you saw, what the caller claimed and what you learned only from the statement. Do not fill gaps with assumptions.
For a card payment, record the displayed merchant, currency, amount, status and date. A statement descriptor may differ from a shop's trading name; check the purchase before accusing an unfamiliar business. Rule out your subscription, delayed debit or another legitimate card user's purchase. If the transaction is not yours, report it promptly.
For transfers, retain account details and status from the bank, not merely an image sent by a buyer or “consultant”. For BLIK, say whether it was a phone-number transfer, purchase or cash withdrawal. If the interface does not show enough, ask the bank to identify it. Do not experiment with a repeat payment to recreate events.
Save the start of the conversation, promised purpose, links and instructions. Separately record when and how you contacted the bank, the case number and measures stated. If a written complaint was requested, submit it and retain acknowledgement. A risk notification should not disappear among routine customer-service questions.
Redact personal information in any copy intended for public discussion. Keep originals privately for the bank, police and authorised representative. Do not send the full archive to someone who contacts you after you post your story: further document theft can begin this way. Do not give that person banking access even for a supposedly free assessment.
If the bank refuses: examine the substance of its answer
Compare the answer with your complaint. Did the bank examine the disputed transactions or merely confirm that the app worked? Did it explain how consent to the particular payment was established? Did it identify the alleged breach of duties and supporting evidence? A generic statement about system security does not answer everything.
Separate your requests: stop further access; try to stop or recover the payment; determine legal responsibility under the complaint. Failure of a technical recall does not necessarily settle the legal dispute. A temporary account block does not mean the bank has acknowledged a debt.
Do not sign an unclear final settlement merely to obtain a quick partial refund without understanding the consequences. Request the document and time to read it. Define any representative's authority: they do not need your PIN, password or remote control of the app. A lawyer assesses documents rather than using your banking secrets to log in as you.
If you bought something but it was not delivered, this may be a seller dispute rather than an unauthorised banking transaction. For a card purchase, ask the bank about any available card-scheme dispute procedure; its conditions and evidence differ from statutory refunds. Do not assume it applies to ordinary transfers or all BLIK transactions.
For the financial ombudsman, prepare a concise list of requests, complaint copy, response and evidence. Do not replace facts with internet legal slogans. If the bank attributes an action to you that did not happen, identify the discrepancy and relevant document. If deadlines or court protection are at issue, do not simply await another informal call.
Helping someone close to you after a scam
Start by protecting money, not blaming them. Shame can make someone conceal further calls and send more money hoping to recover the original loss. Ask whether a call is ongoing, an app was installed, approval requests are arriving or a payment was promised. Help establish independent bank contact and write a timeline.
Do not send a “test” payment even if the person believes the consultant is genuine. Suggest a pause and a branch visit. Instructions to tell nobody are another warning. An interpreter can help, but account instructions and approvals should remain under the customer's control in a reliable channel.
Afterwards, review email and messenger recovery methods, transaction alerts and SIM control. Warn genuine contacts if the profile sent money requests. Do not publish the victim's passport as part of a warning. A useful notice explains the scheme without secrets or promises to catch the offender yourself.
Six practical scenarios
These are composite teaching examples, not accounts of real victims. They illustrate warning signs and actions; legal classification depends on circumstances.
A friend requests BLIK through a messenger
The profile is familiar, but the person will not answer a call and presses for speed. Verify through the old number, not a newly supplied contact. If a code was shared, reject unfamiliar approval requests and check transactions. If debited, contact the bank and report with the conversation; ask your real friend to secure the account. Reference: BLIK guidance.
A parcel-surcharge SMS
A real expected delivery makes it convincing, but the banking approval amount differs from the surcharge. Close the imitation and check the carrier's service. Block the card if its details were entered, even without a completed approval. Forward the SMS to 8080 and retain the address without reopening it. Reference: CERT Polska.
A “security department” call
The caller knows your name, displays the bank's number and forbids hanging up. Disconnect and call the bank yourself. If you already sent money to a “safe account”, immediately request an attempt to stop or recall it and describe the instructions. Do not take out a loan to fix the problem. Reference: Policja warning.
Selling a phone on OLX
A buyer sends a “collect payment” link asking for the card security code. Check the order in your own account; do not follow a new form under pressure. Tell the bank about any exposure; preserve shipping details if the item was sent. Contact the platform independently. Reference: OLX's phishing explanation.
A bank in a search advertisement
A lookalike accepts your password, then asks you to repeat a code. Do not try to finish the process. Close it, contact the bank from a safe device, end outside sessions and check transactions. Secure email too if the password was reused. Reference: UOKiK and CERT.
A profit you cannot withdraw
The dashboard shows gains after an initial investment, but the consultant demands another payment for withdrawal. Do not send more or grant remote access. Keep account details, domains and messages; contact the bank and police. A recovery offer for a fee may continue the same attack. Reference: KNF on recovery scams.
A Polish message to your bank
This is a message template, not a universal legal classification. Choose the description matching the actual events. Do not deny consent unless you can truthfully do so.
Temat: Zgłoszenie podejrzenia oszustwa i reklamacja dotycząca transakcji
Dane klienta: [imię i nazwisko, identyfikator klienta w bezpiecznym kanale]. Data i godzina zdarzenia: [uzupełnij]. Transakcja: [data, kwota, waluta, identyfikator, rachunek odbiorcy, jeśli znany].
Opisuję następujące okoliczności: [kto się kontaktował, co przedstawiono na ekranie, jakie czynności wykonałem/am i kiedy zauważyłem/am problem]. [Jeżeli zgodne z prawdą: Nie wyrażałem/am zgody na wskazaną transakcję.] Proszę o pilne zabezpieczenie dostępu i instrumentów objętych incydentem, weryfikację transakcji oraz podjęcie dostępnych działań w celu zatrzymania lub odzyskania środków.
Jeżeli transakcja była nieautoryzowana, wnoszę o zastosowanie właściwych przepisów ustawy o usługach płatniczych, w tym zasad zwrotu. Proszę o numer zgłoszenia, potwierdzenie przyjęcia reklamacji oraz odpowiedź z uzasadnieniem faktycznym i prawnym na trwałym nośniku. Załączniki: [historia transakcji, korespondencja, potwierdzenie zawiadomienia, jeżeli dostępne].
Remove unused alternatives before sending. Do not include a password, PIN, BLIK code, one-time codes or a full set of card secrets. Use the bank's secure channel. An urgent blocking call and a written complaint serve complementary purposes.
Before returning to everyday payments
Ask the bank how safe access will be restored: a branch visit, new card, app registration or verification of a new device may be needed. Do not follow the suspicious caller's old recovery instructions. If email was used for password resets, secure it before restoring linked accounts.
Review payees, standing orders and registered devices where your bank exposes these details. Preserve useful evidence before deleting an unknown entry; agree protective priorities with the bank. Over the following days, check alerts and history, including transactions initially marked as processing.
If a card was replaced, update subscriptions yourself within known services. Do not follow an unexpected “confirm your new card” email. The scammer may keep posing as bank staff or police after blocking. Knowledge of your case number, if disclosed to outsiders, does not establish identity either.
If the SIM was lost or taken over, restore control with the operator and establish what changed. Restored connectivity does not prove that email and banking are secure. When technically uncertain, ask a competent specialist to inspect the device, explaining remote-access indicators; do not accept repairs from a new random advertiser.
Keep a folder of reports, answers and next-step dates. Distinguish completed actions from promises. This avoids retelling everything and helps detect an unregistered complaint. Your planning dates do not replace individual procedural deadlines if the dispute reaches court.
Prevention without unnecessary apps
- Update your system and apps from verified sources. Do not disable protection on a caller's instructions.
- Use different passwords and additional protection for email and messengers, which often recover other accounts.
- Choose suitable daily limits and transaction alerts. Raise a large limit only for your own planned purchase.
- Read the amount, currency, recipient and transaction type before approving; do not approve by following spoken prompts.
- Keep the bank's verified number separately from suspicious messages.
- Agree with family that urgent money requests are always checked by an independent call.
- For an international transfer, verify recipient details independently, especially after an email changing them.
No checklist provides absolute protection. Pause before an irreversible action. If staff cannot communicate in a language you understand, ask for written explanations or branch assistance; do not give account control to a random “interpreter”.
Frequently asked questions
Can someone receive money using only a BLIK code?
A code is involved in certain transactions, usually followed by approval in the banking app. Do not assume every shared code is harmless: reject unknown requests and check history. Other BLIK services work differently.
What if I pressed approve?
Immediately tell the bank the transaction type and circumstances. Ask it to protect access and register the dispute. Do not assume automatic recovery or conceal your approval: the screen information and actual consent matter.
Does reporting to 8080 cost money?
CERT Polska identifies a free short number for suspicious SMS. Forward the original message. Other incidents can be reported through the official web form; neither route blocks banking instruments.
Can the displayed bank number be fake?
The number and label do not authenticate a caller. Disconnect and establish your own call using verified details. Do not rely on an offered transfer by an unknown person.
Should I transfer money to a safe account if “the bank” asks?
No: that is a characteristic scam instruction. End the conversation and check directly with the bank. If you have already transferred, prompt reporting and an accurate timeline matter.
Is changing my password enough?
Not always. Sessions, registered devices, exposed cards or email access may remain. Discuss the complete response with the bank and do not change passwords on a remotely controlled phone.
Will the bank refund every transfer to a scammer?
No. An unauthorised transaction differs legally from a transfer you genuinely instructed. Assessment is not reduced to a code record: consent, evidence and the applicable rules need examination.
Why is D+1 different from the complaint-response deadline?
D+1 concerns the statutory refund of an unauthorised transaction with specified exceptions. A payment-complaint answer normally takes up to 15 business days, exceptionally up to 35. These are different duties.
Must I go to the police first?
Tell the bank immediately, then report the suspected crime. Do not await the end of an investigation before blocking access or complaining. Keep acknowledgement and add it to the dispute documents.
Can a completed ordinary transfer be cancelled?
Ask the bank urgently to check stopping or recovery options. They depend on the stage and payment route; a completed transfer is not freely cancellable. Do not pay a middleman for guaranteed recovery.
Does an OLX buyer need my card details to pay me?
Do not enter card secrets into a buyer-supplied form. Check the transaction in your official account. Legitimate payment-operator identification may exist, but follows a verified procedure rather than a stranger’s instructions.
Will reserving PESEL help after a leak?
It is separate protection against certain identity-related actions. It does not undo a past debit, block every banking instrument or replace reporting exposure to the bank and competent authorities.
Who can help after the bank refuses?
After complaining, contact Rzecznik Finansowy with the answer and evidence. UOKiK protects collective interests; police investigate crime. Individual recovery may require legal assistance and court proceedings.
Someone offers to recover investments for an advance fee. Is that a solution?
This is a typical repeat-scam risk. Verify the organisation independently, do not grant access and do not send another “unlocking” payment. KNF does not offer a paid recovery service through random consultants.
Sources and review date
Legal provisions were checked against the current Payments Services Act; technical guidance against CERT Polska, BLIK, Policja, OLX, KNF, UOKiK and Rzecznik Finansowy materials linked in the relevant sections. Fraud totals, search volumes and recovery probabilities were not estimated. Future changes are not described as current obligations. New bank warnings or statutory changes require an unscheduled review.