Online fraud: what to do after a transfer, BLIK payment or sharing data?

After suspected fraud, first limit further losses: stop contact with the perpetrator, contact your bank and secure your accounts. Then preserve evidence and notify law enforcement. Reporting a suspicious website to CERT Polska helps limit the threat, but does not replace a bank complaint or crime report.

Updated: 20 October 2026. The procedure depends on what you shared and how payment was made. The sequence below helps organise events; it does not promise a refund.

Record whether you merely opened a website, entered a password, provided a BLIK code, approved a transaction or installed a remote-access app. The actual actions matter to the bank and further assessment, not just the scam's name.

Do not sign in again through the suspicious link to check whether it still works. If you suspect device takeover, contact your bank and change security settings from a safe device.

Ask for the relevant services to be secured and the possibility of stopping or recovering the transfer to be checked. For a card payment, ask about the complaint process and chargeback. CERT Polska's shopping guide recommends promptly notifying the payment provider after buying from a fake shop. Source: CERT Polska, safe shopping guide.

Not every payment to a scammer is automatically unauthorised. If you did not consent to a particular transaction, explain that clearly. Questions about authorisation require the sequence of events to be established. Source: Financial Ombudsman, questions on unauthorised transactions.

If you gave out a password, change it through the official service. Check other accounts where you used the same password. Pay particular attention to email, which is used to restore access.

If identification details were exposed, consider restricting use of your PESEL number through the official service. This provides extra protection; it does not cancel a completed payment. Source: Ministry of Digital Affairs, data and PESEL protection.

If you suspect misuse of identity-card details, check the official procedure for reporting identity theft and invalidating the document. Source: Gov.pl, reporting misuse of personal details.

Prepare a simple chronology and:

• payment confirmations, amounts, dates and recipient details;

• the full website address, advertisement link and profile name;

• messages, emails, telephone numbers and conversation history;

• the bank reference number and complaint responses;

• details of the platform used and any shipment.

Report the suspected crime to the police or prosecutor's office. Do not publish document scans or full account details in groups. Keep original files, not just transcribed conversation excerpts.

Suspicious websites and other incidents can be reported through incydent.cert.pl. Forward a suspicious SMS unchanged to 8080. This is the route specified by CERT Polska's current reporting rules. Source: CERT Polska knowledge base.

Did you only open a suspicious link? Do not return to test the website. Establish whether you entered details, downloaded a file or granted permissions. A click alone does not establish that payment occurred; further action depends on what you actually did and the symptoms you notice.

Did you provide a password or card details? Secure the relevant service through its official channel. Tell the bank what details you disclosed and whether transactions are already visible. Include other accounts that used the same password. Changing a password in one service does not mean every other account has been checked.

Did you make a transfer or share a BLIK code? Report the specific payment to the bank, giving the time, amount and available recipient details. Ask what can be done about that transaction. If you reasonably suspect fraud, do not wait for the seller or consultant to “explain the mistake”.

Did you share remote access to your device? Disconnect it. Contact the bank and secure access from a device you trust. Describe what the caller may have seen or done. If you are unsure about the device, seek technical help rather than following further instructions from an unknown consultant.

Record in one place: initial contact, the request received, your actions, payments, discovery of the problem and reports made. The bank needs transaction information, the police or prosecutor needs details of the suspected crime, and CERT needs the technical threat. The same organised material can help them, but each report serves a different purpose.

Example: you follow an advertisement, buy a product and pay, then the shop disappears. Keep the advertisement, full shop address, order confirmation, payment and correspondence. Describe separately whether you entered card details in a suspicious form. Undelivered goods and exposed-data risks may require parallel action.

• Save full website and profile addresses; the name displayed in a messaging app may not be enough to locate them.

• Keep dated conversations and payment confirmations. Add a short description of what each screenshot shows.

• Distinguish evidence received from the perpetrator from information confirmed by the bank or genuine platform.

• Record reference numbers and replies. The next person should see which steps have already been taken.

• When preparing copies for assessment, agree a secure transfer channel and do not post them in open comments.

Do not delete an account or correspondence solely out of embarrassment or anger. If contact with the perpetrator becomes dangerous, safety takes priority; do not conduct your own “investigation” that requires further payments or sharing details.

Read exactly what the response concerns. Did the bank assess an unauthorised transaction, a card-payment complaint or recovery of an ordered transfer? Does the seller address the order or send a general notice? These distinctions help identify the next step and the right recipient.

Prepare the initial notification, proof of submission, response and missing evidence. Do not change your account merely because you found a different letter template online. If you initially forgot something, supplement the account and explain the source of the new information.

The perpetrator may return as a supposed bank employee, police officer or recovery provider. Knowing your loss amount or the platform's name does not authenticate them. End the conversation and verify the contact independently. Do not provide codes or account access for a “refund”.

Have documents but do not know whom to address next? In your PGW submission, give the incident type, amount, payment method and responses received. This helps establish possible assistance and any missing information, without promising an automatic refund.

I gave out a BLIK code. Is reporting still worthwhile?

Still report the incident to your bank and law enforcement. Liability and available action depend on exactly what happened. The payment method's name alone is not enough for a reliable assessment.

Someone wants a fee to recover the money. What should I do?

Do not provide banking access or codes. Check the company's identity, contract and scope of work. Do not pay solely on a promise that funds have already been found. For investments, also read our guide to cryptocurrency and repeat scams.

Does reporting to CERT alone trigger a refund?

No. Responding to a dangerous website is a different process from a payment complaint and pursuing claims.

If, after your initial reports, you need help organising documents and assessing possible further service, describe the case to PGW. Terms are agreed after assessment, without guaranteeing recovery. Telephone/WhatsApp: +48 720 13 14 15, kontakt@e-pgw.pl, www.e-pgw.pl. Office: Gwiaździsta 6/5, 53-413 Wrocław, by appointment; online service in Poland. PGW is not a law firm. Reserved activities are performed by authorised advocates and Polish legal advisers.

More about complaining to a bank after an unauthorised transaction. All materials: Guide.