AntiBaitby FluenceSecurity

Alert · banks

Fake bank texts and calls in Poland: blocked account, BLIK, “safe account”

Criminals impersonate banks in texts, emails, messengers and phone calls. They write about a blocked account or a suspicious transaction, call from a number that looks like the bank’s helpline, or ask “as a friend” for a BLIK code. The goal is always the same: your login, your card details, or a transfer to their account.

Last reviewed:

What a fake bank message or call looks like

According to CERT Polska, fake bank messages usually say you need to act on your account or that you can receive extra money, and the link leads to a fake online-banking login page (CERT Polska, in Polish). The common patterns:

  • A text or email about a blocked account, a suspicious login or a required “data verification”, with a link to a page posing as the bank’s login.
  • A call from a “consultant” or the “security team”. The caller says your account was blocked or someone is stealing your money, and talks you into moving it to a “safe account” (CERT Polska).
  • A request to install a remote-access app such as AnyDesk “to secure the account”. With access to your screen and account, the criminals make the transfers themselves (CERT Polska).
  • A message from a “friend” on Messenger or WhatsApp asking for a quick loan via a BLIK code. In fact someone has taken over that person’s account and is writing to all their contacts (CERT Polska).
  • An email asking you to “verify a document” and download an attachment. CERT Polska described such a campaign under a bank’s name: the attachment contained data-stealing malware (monthly summary 2/2026).
Illustrative pattern · text messageMade-up example, not a real message
From
YourBank

Your account has been temporarily blocked due to suspicious activity. To unblock it, confirm your details: yourbank-verify[.]xyz

Illustrative pattern · phone callMade-up example, not a real message
From
a number resembling the bank’s helpline

“Good morning, I’m calling from the bank’s security department. We can see an unauthorised transfer attempt from your account.”

“To protect your money it has to be moved to a technical account now. Please also install an app so I can help you do it.”

Illustrative pattern · messengerMade-up example, not a real message
From
a friend’s account

“Hi, can you lend me 200 zł quickly? Send me a BLIK code, I’ll pay you back tomorrow, can’t talk now.”

The usual tricks

A spoofed number

Your phone may show a number identical to your bank’s helpline: criminals can fake it (ZBP, CERT Polska). The number alone proves nothing.

The “safe account”

There is no “technical account” or “safe account” you must move money to for protection. ZBP, the Polish Bank Association: a real adviser will never ask for this (ZBP).

Remote access to your device

Criminals push apps such as TeamViewer QuickSupport or AnyDesk (PKO Bank Polski). Through them they see your screen, capture your data and order transfers themselves.

A fake login page

The link opens a page that looks just like online banking. CERT Polska reminds you to check the address bar before typing in your login (CERT Polska).

A friend’s hijacked account

The BLIK request comes from a friend’s real account, so it feels trustworthy. The scammers count on someone handing over the code without checking who is really writing (CERT Polska).

Time pressure

“If you do nothing, you’ll lose your savings.” Fear and haste are meant to leave no time to think. ZBP’s advice: don’t act under time pressure (ZBP).

What your bank never does

The Polish Financial Supervision Authority (UKNF), the Polish Bank Association (ZBP) and the banks themselves repeat the same rules. A bank employee will never ask you for:

  • your online-banking login and password, or an SMS code authorising a transaction (UKNF);
  • your card number, expiry date and CVV (UKNF), your PIN or personal codes (ZBP);
  • a BLIK code: “a bank employee or a representative of the authorities will never ask you for a BLIK code to protect your money and data” (BLIK);
  • a transfer to an account they name, a “technical account” or a “safe account” (UKNF, ZBP);
  • installing any software: “a bank will never ask its customers to install any software” (UKNF; likewise mBank and ING);
  • logging in from a link in an email. ING: “We don’t send emails asking you to log in or give private details” (ING).

If you gave your details or a BLIK code, or sent money

Act now. The sooner your bank knows, the better the chance of stopping the transfer.

  1. Call your bank immediately

    If card or login details went into the fake page, or a payment was approved, call your bank right away — on the number on the back of your card or on the bank’s official website — and ask them to block the card and access to the account. In Poland you can also block a card on (+48) 828 828 828 (ZBP, in Polish). Every minute counts.

  2. Remove the remote-access app

    If you installed AnyDesk, QuickSupport or a similar program at the caller’s request, end the call and uninstall it. Don’t log in to your bank on that device until you have spoken to the bank.

  3. Change your banking password

    CERT Polska advises changing your online-banking password if it went into a fake page (CERT Polska). If a social media account was taken over, recover it and warn your friends.

  4. Restrict your PESEL number

    If the criminals may have your PESEL number or ID card details, restrict (zastrzeż) your PESEL in the mObywatel app, on gov.pl or at a municipal office. It is free, and banks must check the restriction before granting a loan (gov.pl, in Polish).

  5. Report the fraud to the police

    If you lost money, report it at any police unit or prosecutor’s office (gov.pl: Report a crime, in Polish). Keep the texts, emails, screenshots and transfer confirmations.

  6. Forward the text to 8080

    In Poland, 8080 is CERT Polska’s free number for reporting suspicious texts. Use “Forward” and send the whole message as it is, link included. CERT Polska adds dangerous sites to its warning list, which many Polish operators use to block access to them.

  7. Report the site or email to CERT Polska

    Report a suspicious page through the form at incydent.cert.pl/phishing, or forward the email to [email protected].

More in our guides: what to do after clicking a phishing link, how to report phishing.

Check before you click

Got a suspicious email? Check it with AntiBait.

Paste the message source or upload an .eml or .msg file. AntiBait checks the sender, SPF, DKIM and DMARC, links and attachments, and explains its verdict. In Poland, forward a suspicious text message to 8080.

Check an emailAll scam alerts

Sources

Based on public notices from CERT Polska and from the institutions and companies that criminals impersonate. The companies and institutions named here do not send these messages: criminals impersonate them.

Other alerts