Fake “InPost” texts
A small surcharge, a parcel on hold, “confirm your parcel details”. The link leads to a fake payment page.
Scam alerts
Fake texts and emails: current scams in Poland
Criminals impersonate courier companies, electricity suppliers, government offices, banks and marketplaces. We have collected the most common schemes, based on notices from CERT Polska and the institutions themselves: what the fake message looks like, how to spot it, and what to do if you clicked the link or paid.
Last reviewed:
Fake “DHL” messages
A customs fee, a tiny surcharge, a failed delivery. The link leads to a fake form that steals card details.
Fake electricity bills (PGE and others)
“Unpaid balance, we cut power today.” The disconnection threat pushes you to pay quickly through a fake link.
Fake government messages: mObywatel, ePUAP, tax refunds
A tax refund, a new inbox message, a fine, expiring data. A fake “gov.pl” page harvests card details or bank logins.
Fake bank: blocked account, BLIK, “bank employee”
A text about a blocked account, a request for a BLIK code, a call from “the bank”. Banks never ask for a BLIK code or a transfer to a “safe account”.
OLX and Allegro scams: “buy with delivery”
A “buyer” sends a link to “receive the money”. The page imitates the marketplace and steals card details.
Shared signs
How to spot the scam, whatever the brand
- Haste and threats: your power cut “today”, a blocked account, a tax refund that will be “lost” in 48 hours.
- A small surcharge, or money to collect, both through a link in the message.
- An address that only resembles the real one: the company name or “gov” in the middle, but a different ending. A made-up example:
inpost-surcharge[.]xyz. - A request for card details, a BLIK code, an SMS code, your bank login, or to install an app.
- Contact outside the official channel: WhatsApp instead of the marketplace chat, a text with a link instead of an in-app notification.
- A page’s look and a company logo prove nothing (CERT Polska, in Polish). Go to the company’s or office’s website yourself.
Where to report a suspicious message
- Text message: in Poland, forward it whole, link included, to CERT Polska’s free number 8080 (gov.pl, in Polish).
- Website or email: report it through the form at incydent.cert.pl/phishing, or forward it to
[email protected]. - Lost money: call your bank right away, then report it to the police (gov.pl: Report a crime, in Polish).
- A suspicious email can also be checked with AntiBait first.
Check before you click
Got a suspicious email? Check it with AntiBait.
Paste the message source or upload an .eml or .msg file. AntiBait checks the sender, SPF, DKIM and DMARC, links and attachments, and explains its verdict. In Poland, forward a suspicious text message to 8080.