A fake hotel reservation, a "payment collection" link on OLX, a text message requesting an additional payment for a package—these are some of the most common online fraud schemes in Poland today. While each looks different, the mechanism is almost identical: the victim is misled into either making a transfer themselves or providing their banking login details or card number on a website that merely pretends to be a bank, payment provider, or classifieds website.
The scale of the phenomenon is growing. According to a CERT Polska report, over 28,000 phishing incidents were recorded using the OLX brand alone in 2025, while data from the National Bank of Poland for the fourth quarter of 2025 indicates nearly 125,000 fraudulent non-cash transactions with a total value exceeding PLN 182 million.
The good news is that your money can often be recovered—but only if you act quickly and choose the right legal path. Below, we explain how these scams work, why the way you lost your money determines your options, and what you can do step by step to increase your chances of getting a refund.
Three Schemes, One Mechanism
Fake booking and Booking impersonation
Fraudsters exploit trust in a well-known brand. The victim receives a message—email, text message, or in-app notification—instructing them to "confirm their reservation," "re-verify their card," or "pay extra" under penalty of cancellation. The link leads to a website that looks very similar to a booking panel or payment gateway. After entering their card details, the funds are transferred directly to the criminal. Another variant is a fake accommodation ad (apartment, vacation home), for which the victim pays a deposit via bank transfer—after which contact ceases.
The OLX Method - and Why the Seller is the Victim
Counterintuitively, in classic OLX scams, the victim is usually the seller. After listing the item, a supposed buyer claims to have already paid through "OLX secure payments" and sends a link to "claim" the money. The website appears to be from OLX, a bank, or a payment provider, but its sole purpose is to intercept login details or card numbers. Instead of receiving a transfer, the seller loses the funds from their own account.
It's worth remembering a simple rule: OLX never sends "payment collection" links via SMS, WhatsApp, or Messenger. Any attempt to move the conversation outside the platform's official chat and payment system is a red flag.
Parcel surcharge and fake courier
"Your parcel is awaiting additional payment" or "the courier was unable to deliver the parcel—please add 2.49 PLN"—these are text messages or emails pretending to be from InPost, DPD, DHL, or Poczta Polska. The additional payment amount is intentionally symbolic, because that's not the point: the link leads to a fake payment gateway that steals card details or bank login information. Courier companies do not send text messages with payment links for additional payment—the status of the parcel should only be checked in the official carrier app.
Key legal distinction: authorized or unauthorized transaction
This question determines your rights towards the bank, so it is worth understanding it before filing a complaint.
An unauthorized transaction is one you didn't consent to—for example, when a fraudster, having obtained your login details, orders a transfer or charges your card. In such a case, the principle of the Payment Services Act is that the bank must return the funds, and the burden of proving that the transaction was authorized rests with the bank, not the customer.
A transaction authorized by fraud (so-called APP fraud— authorized push payment fraud) occurs when the victim, misled, approves the transfer via a code or app. Banks then argue that the customer authorized the transaction and refuse to refund. These are the most legally difficult cases, but not hopeless—it is increasingly argued that the mere "authentication" of a transaction does not constitute authorization, and that a bank is liable if it fails to meet its own obligations regarding fraud prevention and recipient verification.
The first hours are decisive
The success rate of recovering your funds decreases with each passing hour. Before you do anything else:
- Call your bank immediately and report the fraud – ask them to block your card and account and, if the transfer has not yet been processed, to try to stop it.
- Change your passwords for banking, email, and any accounts where data may have been leaked.
- Secure evidence —conversation screenshots, ads, links, phone numbers, transfer confirmations, text messages, and emails. Don't delete anything.
- End contact with the scammer. The criminal will often return with a promise of a refund, another link, or threats of account suspension—all in an attempt to obtain further information.
- Report the matter to the police and keep the report number.
Suspicious SMS messages can also be sent to the toll-free number 8080 (CSIRT NASK), and phishing attempts can be reported via the CSIRT NASK form and directly to the platform the fraudster is impersonating.
Ways to recover your money
1. Complaint to the bank - unauthorized transaction
If a fraudster performed a transaction without your consent, a complaint based on the Payment Services Act is the basis. Generally, the bank should refund the amount of an unauthorized transaction immediately, no later than the end of the next business day after reporting it (the "D+1" rule), unless it has a justified and documented suspicion of fraud on the customer's part. The bank is generally obligated to review complaints regarding payment services within 15 business days (up to 35 business days in particularly complex cases). In the complaint, it's a good idea to clearly request a refund as an unauthorized transaction and—if the payment was made by card—to also request a chargeback.
2. Chargeback - when you paid by card
Chargeback is a procedure regulated by Visa and Mastercard payment organizations, independent of the merchant's goodwill. It allows you to recover your money when, for example, you paid for a service or product with your card but didn't receive it, when a website turned out to be a fake store or a fake gateway, or when a double or unauthorized charge occurred. Importantly:
- chargeback applies only to card payments (debit, credit, prepaid);
- does not include regular bank transfers, BLIK or cash deposits at cash deposit machines;
- deadlines apply - depending on the complaint code, usually around 120 days from the transaction, so do not delay;
- The procedure usually takes several weeks (approximately 30–60 days).
3. Reversing or stopping a transfer
If you lost funds through a regular transfer, the sender's bank may request a refund from the recipient's bank. This approach is especially viable in the initial hours—before the fraudster can withdraw the funds from the temporary account. If the recipient fails to return the funds within the specified timeframe, the bank—after a written request—may release their details, allowing for a claim.
4. BLIK — the most difficult case
BLIK payments are technically irreversible. Neither chargebacks nor transfer recalls will work—the only viable option is criminal prosecution and recovery of funds from the perpetrator's assets, if they can be identified and their assets secured.
When the bank refuses to refund
The bank's refusal—often justified by a terse statement that "the transaction was properly authenticated"—doesn't end the matter. You have several further options:
- Appeal (repeated complaint) with a request to provide specific evidence of authorization, not the fact of authentication itself.
- A request for intervention to the Financial Ombudsman is a free, effective instrument of pressure in cases where the bank has rejected the complaint.
- Complaint to the Office of Competition and Consumer Protection, which conducts actions against banks regarding the practice of handling complaints about fraudulent transactions.
- Legal action —claims against the bank (under payment services and contractual liability regulations) or against the perpetrator. Courts are increasingly siding with customers, especially in cases where the fraudster impersonated a bank employee.
Criminal procedure - notification and recovery of damages in the proceedings
Regardless of the actions taken against the bank, online fraud is a crime. Depending on the mechanism, it can involve:
- Article 286 § 1 of the Penal Code (fraud) – causing another person to dispose of property to an unfavorable extent by misleading them, punishable by imprisonment from 6 months to 8 years;
- Article 287 § 1 of the Penal Code (so-called computer fraud) - when the perpetrator, without authorization, influences the automatic processing or transfer of data in order to obtain financial benefits.
A well-prepared crime report isn't a formality. Whether the proceedings proceed smoothly or stall depends on the accuracy of the description, correct legal classification, and completeness of evidence. During the proceedings, the injured party can seek compensation for the damage—a criminal court can order the perpetrator to repay the lost amount, and the prosecutor's office, if it identifies the fraudster, can secure their assets. This is often the only viable path to recovery where complaints and chargebacks have failed—for example, with BLIK payments.
These cases can be challenging: criminals operate in organized groups, often from abroad, using so-called fronts and temporary accounts. However, this doesn't mean reporting them is pointless—law enforcement agencies can secure technical data and conduct operations through international cooperation.
How can we help?
In online fraud cases, timing and the proper sequence of actions are crucial. We help:
- conduct an urgent analysis of the case and choose the right path (complaint, chargeback, transfer recall, criminal proceedings) — preferably in the first hours;
- prepare an effective complaint to the bank and an appeal after a refusal, with the correct basis for liability;
- prepare a notice of a crime with the correct classification under Article 286 or 287 of the Penal Code and a complete set of evidence;
- represent the injured party in preparatory proceedings and in court, including in the scope of compensation for damage and securing the perpetrator’s assets;
- conduct a case before the Financial Ombudsman, the Office of Competition and Consumer Protection and in civil proceedings against the bank or the perpetrator.
If you've fallen victim to a fake booking, OLX scam, or "package surcharge," contact us as soon as possible. The sooner we secure evidence and initiate appropriate procedures, the greater your chance of getting your money back.
This article is for informational purposes only and does not constitute legal advice
Legal status as of June 30, 2026.
Author:
Series editor:
