VERDICT: FALSE
Emails ‘from PKO BP’ asking businesses to update their documentation are a scam. Their aim is to take over access to business banking.
What we checked
PKO BP business customers are receiving emails that look like messages from the bank. They say the business must urgently update or confirm its documentation because the law requires it. The message contains a login link. Many Polish businesses in the UK and many Poles in the UK hold PKO BP accounts, so we checked whether this is a genuine request.
How we checked
We compared two independent warnings from security teams:
- CERT Orange Polska described the campaign on 27 October 2026, with technical details of the fake website.
- CERT Polska (the incident response team operating within NASK) warned PKO BP customers on 28 October 2026. According to CERT Polska, it has received many reports about the campaign. The warning was reported by, among others, Rzeczpospolita.
We checked both sources on 29 October 2026.
What is confirmed and what is not
Confirmed: the link in the email leads to a fake iPKO biznes login page. According to CERT Orange Polska, the page sat at an address impersonating a government domain, and the link hid the server’s real address. The fraudsters take the victim through an entire fake login process. At the end they ask for the SMS code, the second security factor, and meanwhile try to move money out.
Confirmed: there is also a second version – without a link, asking the recipient to send ‘missing documents’. Some messages include a genuine bank document as a PDF to make the email look credible.
Unconfirmed: we do not know how many businesses have lost money. There is also no data on whether the campaign targets businesses abroad.
How to protect yourself
- Do not click links in emails ‘from the bank’. Type the bank’s address yourself or use the official app.
- Be wary of time pressure and threats to block your account.
- Read the whole SMS containing a code – the bank states what the code is for.
- If you get a login alert you did not trigger, call the bank immediately on the number from its official website.
- Report a suspicious email in Poland via incydent.cert.pl, and in the UK forward it to [email protected] (NCSC).
Sources: CERT Orange Polska (27 October 2026); CERT Polska warning reported by Rzeczpospolita (28 October 2026).
We assess factual corrections and substantive responses. Verified changes are reflected in our reporting.
Contact the editorial desk →
