Alert · government and tax
Fake government messages in Poland: mObywatel, ePUAP, gov.pl and tax refunds
Criminals impersonate mObywatel (the Polish government app), the National Revenue Administration (KAS) and other public offices. They promise a tax refund, or write about a new message in your inbox, an unpaid fine or expiring data. The link leads to a page that only looks like a government service, and it harvests card details, bank logins or Profil Zaufany (trusted profile) credentials.
Last reviewed:
What a fake “government” message looks like
CERT Polska and public offices regularly warn about new campaigns. The common patterns:
- A text or email about a tax refund (zwrot podatku), often with an exact amount and a request to confirm your bank account “within 48 hours” (podatki.gov.pl, CERT Polska). The link opens a copy of podatki.gov.pl or e-Urząd Skarbowy (the online tax office) that harvests personal and card details (CERT Polska, CERT Polska).
- A text about a new message in your mObywatel inbox. The link leads to fake pages posing as government sites (gov.pl).
- A message using mObywatel’s look about an unpaid traffic fine, threatening legal consequences, extra fees and a worse credit history. The page asks for your vehicle registration number and then your card details (CERT Polska).
- A text saying you must update your details because they are “expiring”. The page is made to resemble a gov.pl service and harvests your online-banking login and password (CERT Polska).
- A fake “notification” supposedly from KAS or the Ministry of Finance, linking to a fake Profil Zaufany login form (gov.pl).
- From
- +48 5xx xxx xxx
You are entitled to a tax refund of 412.60 zl. Confirm your account number within 48h or the refund will be lost: gov-pl-refund[.]xyz
- From
- +48 7xx xxx xxx
You have an unpaid fine. Avoid extra fees and a debtor register entry: mobywatel-fines[.]xyz
The usual tricks
“gov.pl” in the middle of the address
Polish government sites use the gov.pl domain (gov.pl), so their address ends in .gov.pl, as in podatki.gov.pl. A fake address may contain “gov” or “gov-pl” somewhere in the middle but end differently.
A “48 hours” deadline
A short deadline and a threat that the refund will be lost or fees added are meant to make you act without checking (podatki.gov.pl).
An exact amount
A precise refund sum sounds credible and tempting. CERT Polska described a mass text campaign in which the fraudsters promised specific amounts (CERT Polska).
Card details “for the refund”
The account for a tax refund is given in your tax return (podatki.gov.pl), not through a link in a text. A page asking for your card details to “pay out a refund” is a scam.
Threats of consequences
Fake “fines” threaten legal consequences, extra fees and damage to your credit history (CERT Polska).
A spoofed text sender
Polish operators must block fake sender names that fraudsters use to impersonate public bodies (gov.pl). Names such as mObywatel, ePUAP and gov.pl are reserved (CERT Polska list). Still, judge the content and the link, not just the sender.
How the real offices work
In the institutions’ own words (pages in Polish):
- National Revenue Administration: “KAS does not send emails or texts asking you to confirm your bank account number” (podatki.gov.pl).
- Your tax settlement and refund are in e-Urząd Skarbowy: log in yourself, starting from
podatki.gov.pltyped in by hand (podatki.gov.pl). Tax questions go to the National Tax Information line (KIS): 22 330 03 30. - A tax refund goes to the bank account given in your tax return (podatki.gov.pl).
- Government sites use the gov.pl domain. mObywatel also offers no services for making money (Ministry of Digital Affairs).
- “Go to the institution’s website yourself and check whether the information you received is true” (gov.pl).
If you clicked the link or gave your details
What matters is what went into the fake page: card details, a bank login or a Profil Zaufany login. Act now.
Call your bank immediately
If card or login details went into the fake page, or a payment was approved, call your bank right away — on the number on the back of your card or on the bank’s official website — and ask them to block the card and access to the account. In Poland you can also block a card on (+48) 828 828 828 (ZBP, in Polish). Every minute counts.
Change your Profil Zaufany and bank passwords
If you logged in to Profil Zaufany or online banking on the fake page, change the password on the real service, typing the address yourself. If you sign in to Profil Zaufany through your bank, tell the bank.
Restrict your PESEL number
If the criminals may have your PESEL number or ID card details, restrict (zastrzeż) your PESEL in the mObywatel app, on gov.pl or at a municipal office. It is free, and banks must check the restriction before granting a loan (gov.pl, in Polish).
Forward the text to 8080
In Poland, 8080 is CERT Polska’s free number for reporting suspicious texts. Use “Forward” and send the whole message as it is, link included. CERT Polska adds dangerous sites to its warning list, which many Polish operators use to block access to them.
Report the site or email to CERT Polska
Report a suspicious page through the form at incydent.cert.pl/phishing, or forward the email to
[email protected].Report the fraud to the police
If you lost money, report it at any police unit or prosecutor’s office (gov.pl: Report a crime, in Polish). Keep the texts, emails, screenshots and transfer confirmations.
More in our guides: what to do after clicking a phishing link, how to report phishing.
Check before you click
Got a suspicious email? Check it with AntiBait.
Paste the message source or upload an .eml or .msg file. AntiBait checks the sender, SPF, DKIM and DMARC, links and attachments, and explains its verdict. In Poland, forward a suspicious text message to 8080.
Sources
- podatki.gov.pl: Beware of fake tax-refund messages, 16 Jun 2026 (PL)
- podatki.gov.pl: Beware of fake emails, 22 Jan 2026 (PL)
- podatki.gov.pl: Overpayment and tax due, Q&A (PL)
- gov.pl: Beware of fake texts impersonating mObywatel, 18 Sep 2023 (PL)
- Ministry of Digital Affairs: Cybercriminals impersonate mObywatel (PL)
- gov.pl: Warning about fraudsters impersonating KAS and the Ministry of Finance, 30 Mar 2026 (PL)
- Ministry of Digital Affairs: Another step against abuse in electronic communications, 25 Mar 2024 (PL)
- CERT Polska: SMS sender names reserved for public bodies (PL)
- CERT Polska: Another fake tax-refund campaign, 16 Jun 2026 (PL)
- CERT Polska: Refund message from e-Urząd Skarbowy, 5 Aug 2026 (PL)
- CERT Polska: Tax refund in February? Don’t be fooled, 11 Feb 2026 (PL)
- CERT Polska: Data expiring? 7 Sep 2026 (PL)
- CERT Polska: Fake traffic fines, 29 May 2026 (PL)
- CERT Polska: lista ostrzeżeń przed niebezpiecznymi stronami
- gov.pl: Coraz więcej prób wyłudzenia przez fałszywe SMS-y (numer 8080)
Based on public notices from CERT Polska and from the institutions and companies that criminals impersonate. The companies and institutions named here do not send these messages: criminals impersonate them.