Polish tax authority JPK_VAT email leads to a fake mailbox login

The message looks like something an accounts team cannot postpone: Poland’s National Revenue Administration, KAS, has supposedly found a discrepancy during automated verification of a JPK_VAT tax file. The recipient receives a link and pressure to resolve the issue quickly. Instead of an official tax service, the click opens a page impersonating a webmail login.

CERT Polska described the scheme in a 15 October campaign warning. It confirms an active phishing campaign impersonating KAS and advises recipients to verify the matter through an independent channel without using contact details supplied in the suspicious message.

Breachroad’s conclusion: the JPK_VAT story is not there to explain tax—it moves the reader from a credible business context to a fraudulent login screen. The lesson for any organisation is broader than Poland: finance-themed phishing may target email because a mailbox provides access to invoices, password resets, contacts and further employee impersonation.

How the scenario works

The campaign combines three credibility cues:

• a public institution with which businesses genuinely interact;
• a technical-sounding JPK_VAT discrepancy;
• urgency implying consequences if the recipient does not act.

The context then changes. The email is about tax reporting, yet the landing page asks for mailbox credentials. That discontinuity is one of the strongest warning signs. A tax service should not require a user to authenticate to their workplace mailbox through a form opened from an email.

CERT Polska’s warning does not say that the campaign installs malware or exploits a flaw in JPK. Do not add either mechanism without evidence. The confirmed sequence is KAS impersonation, a claim about discrepancies and redirection to a fake webmail panel.

What to do when the message arrives

Do not follow the link or reply to the sender. Open the relevant service independently from a bookmark or a known address you type yourself. If confirmation is necessary, use contact details obtained independently rather than a phone number or footer in the message.

Send the suspicious message to your security team using the established process. CERT Polska accepts reports through incydent.cert.pl and the “Bezpiecznie w sieci” service in Poland’s mObywatel application. Preserve headers and the complete message; a screenshot alone may omit information needed to analyse the sender and destination.

Do not distribute the live link to colleagues with a “does this look real?” question. That exposes more people to an accidental click. Use the phishing-report function or the forwarding method approved by IT.

If the link was opened

Opening the page does not by itself prove account compromise. Close it, do not download files and report the event with its time, device and browser. The technical team can then review DNS, proxy, EDR and mail records to determine whether redirects or downloads occurred.

If you entered a username and password, act immediately from a clean, official session:

1. contact IT or the account owner;
2. change the password through the genuine portal, without returning to the email link;
3. revoke active sessions and tokens where the service supports it;
4. review MFA methods, forwarding rules, filters and applications connected to the mailbox;
5. check sent mail and sign-in alerts;
6. warn people who may have received messages sent from the compromised account.

Changing the password is necessary but may not be sufficient. An attacker could have added a rule that hides replies, enrolled another sign-in method or retained an active session. The investigation should reflect the mail platform and the evidence available.

Guidance for finance teams and accounting providers

Finance staff receive genuine notices about reporting and payment, so a blanket rule that “institutions never send email” is not useful. A safer process changes the channel:

• treat the message as a signal to check, not as a login location;
• open the known portal independently;
• stop and report when a tax story unexpectedly asks for email credentials;
• require a second person to confirm high-impact actions;
• ensure the help desk can revoke sessions and inspect mailbox rules quickly.

Include outsourced accountants in the process. Agree who receives warnings, how suspicious messages are reported and which account may contact the authority. A shared mailbox without a clear owner often delays response.

A short employee notice

“CERT Polska is warning about emails claiming errors in JPK_VAT tax files. The link may open a fake webmail panel. Do not sign in through it. Check the matter using a known portal or an official authority channel and report the message to IT. If you entered credentials, call the help desk immediately—fast reporting helps protect the account.”

This wording describes the current pattern without blaming the recipient. Campaign facts come from CERT Polska. The assessment of mailbox value, the response after credential entry and the accounting-provider workflow are Breachroad recommendations. Our analysis of fake Polish KSeF notifications offers a related example, while teams can practise safe verification in our cybersecurity and phishing training.