Fake KSeF and gov.pl notifications target businesses

Whenever the regulatory landscape shifts, criminals exploit it immediately. The rollout of Poland’s National e-Invoicing System (KSeF) and the digitalisation of dealings with public administration created a perfect pretext for phishing aimed at businesses — because finance departments expect messages about invoices and official obligations.

What the attack looks like

CERT Polska has warned about campaigns with fake KSeF notifications and phishing that uses domains strikingly similar to gov.pl. A typical message reports a “new invoice in the system”, an “error in your settlement” or a “need to confirm your data”, and leads to:

• a fake login panel (for KSeF, e-government, corporate banking), where the victim gives up their credentials, or
• an attachment or link with malware — a macro in an “invoice”, a file that runs a downloader.

The goal is often to take over the finance team’s mailbox — and from there it’s a short step to CEO fraud (BEC) and swapping the bank account number on invoices.

Why companies are an easy target

• Routine — the finance team opens dozens of invoices a day; one forgery doesn’t stand out.
• The authority of officialdom — “it’s from the Ministry / KSeF” discourages questioning.
• Diffuse responsibility — it’s not always clear who verifies the authenticity of a notification.

What to watch for

• The full domain in the sender’s address and the link. Official services end in gov.pl. ksef.gov.pl.rozliczenia.info is the domain rozliczenia.info.
• Unusual attachments (files with macros, archives, “invoice.pdf.exe”).
• Pressure and threats — penalties, deadlines, blocks.
• A request to log in via a link instead of accessing the system directly.

How to secure your organisation

Technical minimum: properly configured SPF, DKIM and DMARC (which make it harder to impersonate your domain), attachment filtering, blocking macros from the internet, and 2FA on mailboxes and systems. Log into KSeF, e-government and banking only via a manually typed address or a bookmark, never from a link in a message.

Procedurally: introduce second-channel verification of any bank-account change (a call to a known contact) and a clear path for reporting suspicious emails to IT. These are exactly the “limit the impact” principles we write about in our piece on breach response — because a compromised finance mailbox can cost a company far more than a single invoice.

Preparing your company for KSeF? Make sure your accounting team can tell genuine notifications from phishing — we offer training and social engineering tests plus consultations for finance teams.

What official warnings confirm

Poland’s National Revenue Administration warned about messages impersonating tax administration and PUESC that promise a tax refund or demand urgent data confirmation. The targets include personal data, PESEL, Trusted Profile and bank credentials. A sender name may mention the institution while the domain after @ does not belong to gov.pl.

This does not mean every KSeF message is fraudulent. Verify in the official KSeF service or through the KAS helpline, without using contact data supplied in the suspicious message.

Accounting-team procedure

1. Stop processing and preserve the message with headers.
2. Open KSeF from a saved bookmark and inspect the invoice or notification there.
3. Verify supplier bank-detail changes using a number already stored in ERP or the contract.
4. Report suspicious invoices through “Zgłoszenie nadużycia” in Aplikacja Podatnika KSeF 2.0.
5. Send suspicious email or SMS evidence to the security team and CERT Polska.

KSeF permissions and tokens

Do not use one broad permission for the whole office. Separate issue, read and administration capabilities, assign owners and review delegation periodically. Store integration tokens or certificates in a secret vault and rotate under procedure. An accounting mailbox should not automatically administer KSeF access.

Response after data disclosure

If a user entered a password or approved a sign-in, reset credentials from a clean device, revoke sessions and review MFA immediately. Contact the bank where payment data was exposed. Inspect mailbox rules, OAuth applications and activity in KSeF and finance systems. Deleting the email is not incident closure.

Sources: KAS — criminals impersonating KAS and PUESC, KSeF — reporting scam invoices, KIS — false email warning.