AntiBaitby FluenceSecurity

Alert · electricity bills

Fake “PGE” texts and emails: power cut-off, unpaid bill, overpayment refund

Criminals impersonate PGE and other Polish electricity suppliers. They threaten to cut your power over an unpaid bill, or tempt you with a refund of an overpayment. The link leads to a fake payment page or a copy of the customer-portal login, and whatever you type in goes to the fraudsters.

Last reviewed:

What a fake “electricity supplier” message looks like

The same patterns keep coming back under different energy brands. The most common ones:

  • A text about a planned power cut over an unpaid bill, offering to pay at once by link, quick transfer or BLIK. The link opens a page that looks just like the PGE customer-portal (eBOK) login (PGE, in Polish).
  • A message about a detected overpayment you can get back. The link leads to a fake login panel, and the details entered go straight to the criminals (CERT Polska).
  • An email with a payment demand sent from an address that only resembles the supplier’s (PGE).
  • A “consumption forecast correction” message posing as an energy supplier, after your personal and card details (CERT Polska).
  • A cut-off threat over a tiny amount, such as “only 3 zł”. CERT Polska warns that the real risk is far bigger: the link leads to a fake payment panel (CERT Polska).
Illustrative pattern · text messageMade-up example, not a real message
From
+48 5xx xxx xxx

Due to an unpaid invoice your electricity will be disconnected today at 21:00. To avoid this, pay the balance of 4.99 zl: power-payment24[.]xyz

Illustrative pattern · emailMade-up example, not a real message
From
Customer Service <refunds@energy-billing[.]xyz>
Subject
Refund of your electricity overpayment

We have found an overpayment of 186.40 zł on your account. To receive the refund, log in and confirm your card details within 24 hours.

Button: “Get your refund”

The usual tricks

Cut off “today”

A threat to cut your power within hours is meant to make you pay without checking. TAURON, for one, says that when a bill is overdue it sends a payment-demand letter with a 14-day deadline (TAURON).

A laughably small amount

A few złoty doesn’t raise alarm. But the fake payment page takes your full card details or your bank login, which opens the way to much bigger losses (CERT Polska).

A refund instead of a threat

Instead of scaring you, the message promises money: an overpayment to collect once you log in. The goal is the same: your login details (CERT Polska).

A fake customer portal

The page looks like the supplier’s customer-portal login. CERT Polska reminds you that a page’s look or a company logo is not enough to prove it is genuine (CERT Polska).

An “almost” official address

The sender or page address contains the company name or words like “billing”, “invoices” or “energy”, but doesn’t belong to the supplier. A made-up example: pge-billing[.]xyz.

An “invoice” attachment

A fake payment demand may carry a link or an attachment posing as an invoice. TAURON says it doesn’t send invoices by email, only a notice that one has been issued (TAURON).

How to tell a real message from your supplier

This is how the suppliers themselves describe their rules (pages in Polish):

  • PGE: “PGE does not send messages calling for urgent payment through a given link” (PGE).
  • PGE: a genuine overdue-payment reminder always gives your customer number, the invoice or document number, the due date and the amount, and has no link straight to an online payment system (PGE).
  • PGE: log in to eBOK only through PGE’s official website or official app, and check the address bar. If in doubt, PGE asks you to call its helpline: 422 222 222 (PGE).
  • TAURON: “We never send payment-reminder emails or texts with a link” (TAURON); its emails don’t contain quick-payment links such as PayU or BLIK either (TAURON).
  • TAURON: pay only to the bank account number on your electricity invoice, and check a doubtful invoice in the customer portal (TAURON).

If you clicked the link or paid

What matters most is what was typed into the fake page. If card or bank login details went in, or a payment was approved, act now.

  1. Call your bank immediately

    If card or login details went into the fake page, or a payment was approved, call your bank right away — on the number on the back of your card or on the bank’s official website — and ask them to block the card and access to the account. In Poland you can also block a card on (+48) 828 828 828 (ZBP, in Polish). Every minute counts.

  2. Change your customer-portal password

    If your eBOK or other supplier-portal login went into the fake page, change the password on the real portal and check that nobody changed your details there. If in doubt, call the supplier’s helpline.

  3. Forward the text to 8080

    In Poland, 8080 is CERT Polska’s free number for reporting suspicious texts. Use “Forward” and send the whole message as it is, link included. CERT Polska adds dangerous sites to its warning list, which many Polish operators use to block access to them.

  4. Report the site or email to CERT Polska

    Report a suspicious page through the form at incydent.cert.pl/phishing, or forward the email to [email protected].

  5. Report the fraud to the police

    If you lost money, report it at any police unit or prosecutor’s office (gov.pl: Report a crime, in Polish). Keep the texts, emails, screenshots and transfer confirmations.

More in our guides: what to do after clicking a phishing link, how to report phishing.

Check before you click

Got a suspicious email? Check it with AntiBait.

Paste the message source or upload an .eml or .msg file. AntiBait checks the sender, SPF, DKIM and DMARC, links and attachments, and explains its verdict. In Poland, forward a suspicious text message to 8080.

Check an emailAll scam alerts

Sources

Based on public notices from CERT Polska and from the institutions and companies that criminals impersonate. The companies and institutions named here do not send these messages: criminals impersonate them.

Other alerts