In brief

• CERT Polska and PKO BP warn of fake emails posing as the bank and demanding data updates.
• The messages claim account functions may be restricted unless the customer confirms identity.
• The emails lead to fake iPKO-style login pages that can capture credentials and enable account takeover.
• Customers should avoid links and log in only through official channels.

How the scam works

Cybercriminals are sending messages that appear to come from PKO Bank Polski, telling recipients that their personal data must be refreshed and their identity confirmed. According to CERT Polska, the emails create a sense of urgency by warning that access to the account could be blocked. (Klienci PKO BP na celowniku oszustów. Uważaj na wiadomości dotyczące konta – wrzuc.info) (Komunikat CERT Polska. Dotyczy wszystkich klientów PKO BP – Dobreprogramy)

The messages typically claim that the bank is carrying out a periodic verification and that some functions, including domestic and foreign transfers and daily transaction limits, may be temporarily restricted until the customer acts. The senders' addresses vary, but the sender name may show the bank's name. (PKO BP ostrzega przed oszustami. Podszywają się pod bank – Biznes Wprost – wprost.pl)

A common variant refers to regulatory obligations, citing the EU PSD2 directive and Polish anti-money-laundering legislation, and asks the recipient to confirm details in the iPKO service within a short time. Some versions warn that failure to respond would require a visit to a branch. (Alert dla mieszkańców powiatu wadowickiego. Uwaga na fałszywe maile od banku PKO BP | Wadowice24.pl – wadowice24.pl)

Warning signs

The emails link to a counterfeit website that imitates the bank's online service. Anyone who enters a login and password there risks handing them directly to the fraudsters, which can lead to the takeover of online banking and loss of funds. (Klienci PKO BP zagrożeni! Jeden błąd może kosztować oszczędności – Super Biznes)

What customers should do

PKO BP does not ask customers to update data or confirm identity through links in unsolicited emails. Customers who receive such a message should not click any link or open attachments. Instead, they should log in to the official app or website by typing the address manually, and contact the bank through its official channels if in doubt. Anyone who has already entered login details should change their passwords immediately and notify the bank.