Poland Scams: Online, Banking & Investment Fraud Guide
Common scams in Poland and how to report to CERT Polska, the police, UOKiK, and your bank.
Emergency number: 112 — verify on official sources.
Last reviewed: 1 August 2026
Poland faces significant volumes of online fraud including phishing and smishing impersonating banks or courier companies, investment scams, and social engineering attacks. CERT Polska (cert.pl) operated by NASK is the national cybersecurity incident response team and maintains a public list of dangerous and phishing websites. Criminal complaints are handled by the police, and the Central Cybercrime Bureau (CBZC) specialises in digital offences.
Poland's most distinctive fraud is the BLIK code scam: a hacked Facebook or WhatsApp account messages the victim's friends with a small emergency — 'can you pay for my taxi, I'll pay you back tonight' — and asks for a BLIK code, which the fraudster uses to withdraw cash at an ATM. Because the plea comes from a real friend's account, it works at scale; the countermeasure is simply calling the friend before sharing any code. Classified-ad fraud on OLX and Vinted is the second staple: fake 'buyers' send links to counterfeit courier or payment pages that ask for full card details 'to receive the money' — a legitimate sale never requires your card number or codes to receive payment.
Older social-engineering patterns persist alongside: the 'na wnuczka' (grandchild) and 'na policjanta' (fake policeman) phone scams still strip elderly victims of savings, sometimes combining both — a fake officer 'investigating' the grandchild scam who needs your cash as 'evidence'. Investment fraud leans heavily on fake celebrity and state-company branding, with ads impersonating well-known Polish figures and companies to funnel victims into fake trading platforms, followed by 'account managers' coaching deposits by phone. Remote-access 'bank helpdesk' calls complete the picture. Report incidents to CERT Polska (which also takes suspicious SMS forwards), your bank immediately when money moves, and the police or CBZC for criminal complaints.
Common scams
- Phishing and smishing impersonating Polish banks or InPost parcels
- Investment and crypto fraud
- Online marketplace (OLX, Allegro) non-delivery and overpayment scams
- Remote-access fraud via fake bank helpdesk calls
Tourist-specific scams
- Overcharging unlicensed taxis in city centres
- Fake tour or accommodation listings
- Inflated menu prices and 'special' bills in tourist-district venues
Online shopping scams
- Parcel-fee smishing impersonating InPost or DPD
- Fake online shops
- Account takeover phishing targeting banking credentials
- OLX/Vinted 'buyer' links harvesting card details on fake courier pages
Job scams
- Task scams via messaging apps
- Fake job offers requiring upfront registration or document fees
- Money-mule recruitment via 'easy transfer' work ads
Romance scams
- Dating-app romance and cryptocurrency investment grooming
- Hacked-account 'friend in need' messages asking for BLIK codes
- Long-distance partners with escalating emergencies
Investment scams
- Fake trading platforms and clone broker firms
- Crypto and 'AI bot' investment schemes
- Ads impersonating Polish celebrities and state companies to recruit deposits
How to report a scam here
- Contact your bank immediately if money was transferred
- Report cybersecurity incidents to CERT Polska at incydent.cert.pl
- File a criminal report at the nearest police station or with the CBZC
- Report consumer fraud to UOKiK at uokik.gov.pl
Local reporting & protection links
Always verify reporting routes and emergency contacts on the official government or agency website for your country.
Bank & payment guidance
Ring your bank now, using the number on your card or the official app rather than anything sent to you in a message. Polish banks can attempt to recall a fraudulent transfer most effectively within the first few hours, and for a shared BLIK code minutes count, because the cash is typically withdrawn at an ATM almost immediately. Tell them plainly that you were tricked into authorising the payment, ask for the receiving account to be reported, and write down the reference number they give you. If you entered card details on a fake courier or payment page from an OLX or Vinted conversation, have the card blocked and reissued at once and dispute any charges. File a police or CBZC report so your bank claim has a case number behind it, reset your online-banking login from a clean device, and warn the friend whose hacked account contacted you — their other contacts are being worked through as well.
Evidence to preserve
- Screenshot all messages, profiles, websites and payment pages
- Save transaction references, account numbers and crypto wallet addresses
- Keep emails with full headers where possible
- Note dates, times, names and phone numbers used
Frequently asked questions
What is CERT Polska?
CERT Polska (cert.pl) is Poland's national cybersecurity incident response team, operated by NASK. It maintains a public warning list of phishing and dangerous websites and allows citizens to report cybersecurity incidents at incydent.cert.pl.
What is the BLIK scam?
Scammers impersonate a friend on social media claiming to be in urgent need of money, asking you to share a BLIK code. The code allows them to withdraw cash from ATMs. Never share a BLIK code with anyone, even someone who appears to be a friend — verify by calling them directly.
How do I report cybercrime in Poland?
Report cybersecurity incidents to CERT Polska at incydent.cert.pl. For criminal matters, file a report at your nearest police station or submit information to the Central Cybercrime Bureau (CBZC) via cbzc.policja.gov.pl.
Sources
- National police and cybercrime portals (verify on official sites)
- FTC / Action Fraud / Scamwatch consumer guidance