The National Revenue Administration warns of another wave of phishing scams. Criminals are sending e-mails informing recipients of an alleged refund of overpaid PIT and urging them to confirm their details and update their bank account.
This is another attempt to exploit the image of a public institution to obtain information that criminals could use to steal money or take control of an account.
Fake tax refund message
According to KAS, scammers convince recipients that, in order to receive a tax refund, they must confirm their identity and “update their preferred payment method”.
The messages are designed to appear to be official correspondence related to the e-Tax Office. Criminals also use information about the recipient’s tax return to make the message seem more credible.
The message may also create a sense of urgency. In the case described by KAS, the recipient is told that they have only 48 hours to confirm their details.
KAS: do not provide data or click suspicious links
The National Revenue Administration emphasizes that it does not send e-mails or SMS messages requesting confirmation of a bank account number or the provision of data to process a refund of overpaid personal income tax (PIT).
This is precisely the element that should raise particular suspicion. A message about an alleged tax refund that requires clicking a link, confirming one’s identity or providing banking details may be a phishing attempt.
KAS advises caution with messages urging immediate action, especially when their authors try to create pressure by setting a short deadline for carrying out the requested activity.
This is what the fake letter looks like
KAS published an example of a message used by scammers. It reads:
Tax refund notification
e-Tax Office
Decision on the refund of overpaid tax
Dear Taxpayer,
The Ministry of Finance informs you that, following verification of your annual tax return for 2025, you have been granted a refund of overpaid income tax.
Refund amount granted:
2 358.50 PLN
For the funds to be safely credited to your bank account, please confirm your identity and update your preferred payment method in the secure e-Tax Office system.
Warning: In accordance with the operating procedure, the link expires within 48 hours of delivery of this message.
Claim your tax refund
If confirmation is not provided within the specified period, the funds will be sent by Polish Post to the registered address, extending the waiting time to 30 business days.
This message was generated automatically by the e-Tax Office system. Please do not reply.
Ministry of Finance, ul. Świętokrzyska 12, 00-916 Warsaw.
Republic of Poland | National Revenue Administration
Scammers use tax refunds as bait
The scam is based on a simple scheme. The recipient is informed that they are entitled to a tax refund and is then directed to an alleged e-Tax Office system. In reality, the link may lead to a website prepared by criminals.
The aim may be to persuade the victim to enter personal data, login details, bank account information or other information that could be used for further scams.
A request for data under time pressure should be considered particularly suspicious. In this case, the scammers claim that the link will expire after 48 hours, encouraging the recipient to act quickly without carefully checking the message.
What should you do if you receive such a message?
Above all, do not click the link contained in it or provide any data. You should also not reply to the message.
If you want to check information about your tax return, it is best to access the official tax administration service yourself instead of using the link in the received e-mail or SMS.
It is also worth checking the sender’s address, the appearance of the website, language errors and unusual requests for banking details. The mere presence of names such as “Ministry of Finance”, “KAS” or “e-Tax Office” does not mean that the message actually comes from the tax administration.
KAS warns taxpayers
The KAS warning is particularly important during a period when taxpayers may expect information related to their tax returns. Criminals exploit such circumstances to make fake messages appear credible.
The most important rule is simple: KAS does not ask by e-mail or SMS for a bank account number or the data needed to process a refund of overpaid PIT.
If a message encourages you to click a link and “confirm your identity” in connection with a tax refund, exercise particular caution. It may be phishing intended to obtain data or money.