Polish Post warns: beware of new cyber fraud campaigns
CERT Poczta Polska has detected a new phishing campaign conducted via SMS. Cybercriminals impersonated Poczta Polska, informing recipients that they would need to pay customs duties on their shipments. Learn more about the methods used by scammers below and how to effectively protect yourself against them.
The new scam involved sending text messages informing customers that customs duties would need to be paid on their shipment. The link led to a website resembling the Polish Post website, but operating at a different address. The criminals aimed to obtain payment card and personal information.
The fraudulent domain was reported to CERT Polska and the registrar. In cooperation with CERT Orange Polska, steps were taken to block the website, which is now unavailable. However, it's important to note that similar campaigns appear regularly, using new web addresses and altered message content.
How do cybercriminals operate?
Fraudsters most often impersonate well-known and trusted institutions: courier companies, banks, government offices, the police, or service providers. They exploit urgency and emotions to persuade recipients to click on links, provide their data, or make a transfer. They use emails, text messages, and phone calls.
"Poczta Polska does not ask for personal data over the phone, especially if an employee calls a customer without prior contact from you. A postal employee does not ask for your PESEL number, ID number, passwords, or codes. In such a situation, you should end the call, do not call back the number from which you made the call, and call the official Poczta Polska hotline yourself: 801 333 444 or (+48) 43 842 06 00. You can check whether the contact was genuine by calling these numbers ," says Tomasz Zawisza, Director of the Cybersecurity and IT Standards Department at Poczta Polska.
The most common scammers' cover stories are:
- additional shipping or customs duty;
- problem with parcel delivery;
- refund;
- arrears to the office;
- the need to update data;
- threat to savings in your bank account.
More and more often, not only seniors fall victim to this, but also young people and those who actively use online services.
How to recognize a fake SMS or email?
If a message purports to come from Poczta Polska or Pocztex, pay attention to the following warning signs:
- information about a small additional payment, e.g. a few zlotys;
- time pressure: "pay within 24 hours";
- link leading to an unknown domain;
- linguistic errors, typos, unnatural wording;
- request for card details, login, password or BLIK code;
- message from an unusual phone number or from an unknown sender.
Please note that the official Poczta Polska websites operate under the domains poczta-polska.pl and pocztex.pl. Always verify the full website address before clicking.
What to do if you receive a suspicious message?
- Do not click on the link.
- Do not provide any data.
- Do not make the payment.
- Verify the information yourself, e.g. via the company's official website or hotline.
- Report the message to the appropriate authorities.
- Delete the SMS or email only after completing the report.
If you clicked the link and provided data:
- contact your bank immediately;
- block the card or access to electronic banking;
- change account passwords;
- report the matter to the police.
Where to report attempted fraud?
CERT Poland
Forward the suspicious text message to 8080.Specialists will analyze the report and may take action to block the domains in question.
Poczta Polska
If the message appears to be from Poczta Polska or Pocztex, please report the incident to: jako@poczta-polska.pl. This will help us warn customers and monitor new scam campaigns.
Bank
If you have provided your card or banking login details, please contact your bank immediately upon discovering the incident.
Police
If money has been lost or data has been disclosed, file a crime report.
How to prepare an application?
Don't delete the message immediately. Keep:
- sender number;
- content of the SMS or e-mail;
- screenshot of the message;
- address of the page to which the link led.
Remember that the sooner you report a fraud attempt, the greater the chance that the domains being used will be blocked and other users will be warned.