Poland

In the scam cases the courts finished in 2024, the people who lost money were mostly private individuals, and mostly men. Nearly half the cases were a sale or a service offered entirely online. OLX and Facebook Marketplace were the point of contact in about 70 percent of those. The usual approach was payment up front, then silence. Where money was lost, half the cases were not above PLN 2,000, though a few large sums pulled the average to about PLN 10,100.

A second route is the impersonation scam the police call a legend: a story built on fear, trust or duty, often a caller posing as a police officer. In 2025 the police recorded 5,226 of these scams, with 5,409 people affected and PLN 158.7 million taken. In October 2025 they described a version on messengers, social media and the phone: someone posing as family, a friend, bank staff or the police, pressing for an instant BLIK transfer, sometimes with a faked voice. They put internet scams in the first half of 2025 at almost 52,000.

CERT Polska logged 28,462 incidents copying OLX and 22,513 copying Allegro, plus messages about a parcel or a tax refund. The national victimisation survey asks about money taken from an account or a card, an online purchase that never arrives, a hacked email or social account, and personal data used for a loan. People convicted in the court files were mostly Polish men, aged 33 on average, and often the holder of the account that received the transfer.

Most of the recorded money moves as a bank transfer, not on a card. In the fourth quarter of 2025 credit transfers were PLN 157.4 million of PLN 182.7 million lost, 86 percent of the value, while cards were 73 percent of the payments and about 14 percent of the money. The four quarterly transfer rows add to PLN 668.7 million. Since 2024 the series includes people talked into sending the money or handing over the codes, by a supposed bank employee, a police officer or an investment adviser. That manipulation was 16,900 transfers and PLN 141.8 million in the second quarter, 82 percent of the money lost on transfers, and 28,100 transfers and PLN 119.1 million in the fourth, 76 percent of that money.

On cards, the fourth quarter was dominated by remote payments made abroad without strong customer authentication, 52 percent of the card scams the issuers reported. Paying at a Polish shop terminal, where that check is used, was the smallest slice. Stolen card data accounted for 43,780 of the issuer's card scam cases.

What stops a payment in time is that shop-terminal check, plus 790 text-message patterns from CERT Polska, on which 1.9 million messages were blocked, and the blocking of calls that hide the caller's number, about 5 million a week and 25 million a week at the end of the year. A transfer the customer confirms still goes through, and often lands in another person's account. The cybercrime bureau froze PLN 14 million in cryptocurrency inside PLN 80.8 million secured.

The central bank's total for cashless payments counted as scams in 2025 is PLN 763.4 million, on 448,484 payments. In the fourth quarter the payment firms themselves bore PLN 17.9 million of the money lost on transfers, 11.4 percent of that value, and card issuers bore PLN 14.7 million, 58.2 percent of the money lost on cards, with cardholders bearing most of what remained on cards. On the impersonation scams the police call a legend, officers got back PLN 5.0 million of the PLN 158.7 million taken. The Central Cybercrime Bureau, on its own charts, recorded PLN 537 million in losses, froze PLN 80.8 million (including PLN 14 million in cryptocurrency) and recovered PLN 24.9 million.

For a payment the customer did not authorise, the Payment Services Act tells the provider to return the sum by the end of the next working day and to put the account back, unless the provider has a documented reason to suspect a scam and writes to the police. The customer can be left with the zloty equivalent of 50 euro if a lost or stolen card was used, or with the whole loss if they acted on purpose or with gross negligence. If the provider did not ask for strong authentication, the customer bears none of an unauthorised payment unless they meant it to happen. A transfer the customer was persuaded to confirm sits outside that next-day return. In the court cases that did reach a finish, half the losses were not above PLN 2,000.

US$79.2m (PLN 297.7m) of it was returned to victims, 10.6% of the money lost.

In the 2024 national victimisation survey, 21.1 percent of people who had money taken or attempted from an account or a card said the case went to the police. The share was 17.9 percent for an online shopping scam, 11.9 percent for a hacked email or social account, and 23.2 percent for personal data used for a loan or a utilities contract. The police register itself rose from 146,553 scam cases in 2023 to 154,263 in 2024 and 158,877 in 2025. Prosecutors received 155,494 of these cases in 2024.

CERT Polska, the national incident team, received 658,320 reports in 2025, up 10 percent from 601,000 in 2024, and registered 260,783 incidents, of which 253,238 were scams by computer. It also took 295,200 reports of suspicious text messages. Payment firms reported 448,484 cashless scam payments to the central bank. Under the 2023 electronic-communications act, CERT Polska builds the text-message patterns and passes them to the telecoms firms, the telecoms regulator and the Central Cybercrime Bureau, which charged 1,374 people in 2025. In the scam cases the courts finished in 2024, the bank was the one that filed the police report in 13 cases, usually after the customer had already been to the bank.

The figure on this page is 158,877 scam cases recorded by the police of Poland in 2025 under article 286 of the Penal Code, the fraud offence. It is the national register, compiled by the Institute of Justice from Police Headquarters, and it is the highest total in the series from 1999. The basic form of the offence is 154,170 of those cases. The same table records 8,231 offences against a computer system, 4,287 credit and loan offences and 63 insurance offences. Article 286 is 92.7 percent of those four qualifications together. Internet scams are usually entered under it. The count rose from 154,263 in 2024 and from 146,553 in 2023.

Inside that work, impersonation scams on a legend were 5,226 cases in 2025, with PLN 158.7 million taken, 641 people detained and PLN 5.0 million recovered. The economic-crime units established 75,236 business scams, which is a separate police book. The Central Cybercrime Bureau started 577 proceedings, finished 556, and established 1,946 offences, 44 percent of its own proceedings being internet scams. It recorded 1,374 suspects, arrested 1,177 and saw 417 remanded. The basic form carries imprisonment from 6 months to 8 years. In 2024 prosecutors received 155,494 of these cases and sent 19,648 to court.

On the police register ordinary scam cases dwarf the neighbour: 158,877 cases in 2025, against 8,231 offences against a computer system. In the cases the courts finished in 2024, nearly half were a fake sale or service arranged online, then a loan scam (about 15 percent), a service taken without paying (about 12 percent) and an in-person deal (about 11 percent). Impersonation, romance, and a phishing or BLIK script were each a few percent. About two thirds of those court cases used the internet or the phone. OLX or Facebook Marketplace was how the online sale started in about 70 percent of them: payment first, then no goods.

By money the picture is a transfer, not a card. Credit transfers were about PLN 669 million of the central bank's PLN 763.4 million in 2025, and in the fourth quarter they were 86 percent of the value from 27 percent of the payments. Most of that transfer money was the customer being talked into sending it, by someone posing as a bank employee, a police officer or an investment adviser. The average scam transfer in that quarter was about PLN 4,740, against about PLN 276 on a card. CERT Polska's largest type of scam was phishing, 78,391 incidents, led by pages copying OLX (28,462) and Allegro (22,513), alongside fake shops and investment pitches that borrow the name of an energy firm or a public figure.

Poland has tied the telecoms firms to the national incident team and the police. The Act of 28 July 2023 makes telecoms firms block text messages that match patterns from CERT Polska, and block calls that hide the caller's number. CERT Polska passes those patterns to the firms, to the telecoms regulator and to the Central Cybercrime Bureau. In 2025 that produced 790 patterns, 1.9 million blocked messages on CERT Polska's count (1.88 million on the regulator's), about 5 million hidden-number calls blocked in a typical week and 25 million in a week at the end of the year, and 244,300 domains added to the warning list. The bureau charged 1,374 people, froze PLN 80.8 million and recovered PLN 24.9 million.

The case count still rose, from 154,263 scam cases in 2024 to 158,877 in 2025, and transfer scams kept climbing because the customer authorises the payment. Payment firms bore 11.4 percent of the money lost on transfers in the fourth quarter. The next-day refund in the Payment Services Act covers a payment the customer did not authorise, which is a different payment from one they were persuaded to confirm. A free check that a euro transfer matches the account name becomes a duty for Polish payment firms on 9 July 2027. In March 2025 Meta told CERT Polska it would not automatically block material that uses domains on the warning list, so the platform side of the same list is not under the telecoms duty.