Criminals act like large corporations, have their marketers, study the market and adapt campaigns to events in the country on an ongoing basis. Paweł Piekutowski from the UKNF says about what the backstage of their “work” looks like in the crosshairs and what new threats brings.
Statistics show that the number of domains dealing with phishing, which you block, is dynamically growing. Is phishing, or extorting personal data, today is the biggest problem when it comes to financial fraud?
Paweł Piekutowski, UKNF: Phishing pages have long been used for various types of scams, including fraud related to the financial market. The CSIRT KNF team operating in the UKNF structures detected about 50,000 in 2025. phishing pages, of which over 40,000 were related to investment fraud. They use the logos of large state -owned companies, the images of celebrities, urging users to put money in non -existent investments. The website is only a lure, a hook. The fraud itself takes place through a telephone connection and conversation with the victim. Advertisements displayed on large digital platforms, on social media, but also on known news sites are directed to the website. Together with CERT Polska, we try to block this type of websites, they go to the list of warnings, and then are blocked by telecommunications operators.
Do you locate such domains yourself or do you get applications from users?
We identify the majority ourselves using analytical tools, but we also receive applications from users and entities from the financial market, which makes it easier for us to complete this task.
The high dynamics of blocked pages is the result of your greater effectiveness Does the scale of this phenomenon gain strength?
Both. The effectiveness of actions taken by CSIRT KNF and CERT Polska teams is growing, but we also see a significant increase in extortion attempts. The intensification of phishing attacks also results from changes in criminal activities. The number of financial fraud is growing because they bring criminals the greatest profits, and at the same time do not generate high costs. The laws of economics also operate in this market.
Scam Romance frauds are considered to be the most profitable criminal activity. Manipulated people, guided by emotions, give criminals savings of life. Fortunately, this kind of fraud is not much in Poland.
Scam Romance frauds are lifting stories in the media and therefore it is loud about them, hence the feeling that the scale of this practice is very large. In fact, criminals are much more likely to tempt with the prospect of great earnings than great love. There are also many amateurs of large profits. More and more people are tempted by the prospect of obtaining passive income, which criminals are able to work perfectly.
In my opinion, all these ads are incredibly trivial, the level of communication language is weak, vision of gigantic earnings absolutely unreal. And people get caught at all.
The message is properly targeted. Criminals carefully select age groups and a way of communication. If the purpose of the attack is younger, then the images of YouTubers are used to advertise false investments. In communication with older people, advertising with celebrities and state -owned companies is used. Criminals operate by trial and error. They release the campaign, observe what interest is, what forms of communication operate in a given target group. These are very well organized, multi -person criminal groups, whose way of action can be compared to the activities of large corporations. They have marketing and promotion specialists who can count money, create campaigns, check how well they “sell”.
Have there been any campaigns recently that surprised with form, a way of communication?
I saw a lot of them and what is still surprising to me is the permanent adaptation of criminals to the market. They adapt the message to the current economic and political situation. There are reports of farmers' protests in the media and we immediately have false ads related to this topic. Flood? There is immediately a flood of fraudulent rebounds on the victims. Sports success – And you can be sure that criminals will take the opportunity to use the image of an athlete.
In January there was the inauguration of President Trump and politicians appeared immediately in advertising in Poland.
Images of politicians are really often used. Recently, the trend of fraud on law firms that help recover money extorted by fraudsters has been getting stronger. This is a very dangerous phenomenon, because we record a lot of cases when a deceived person finds an advertisement for a compensation company, makes contact with him in the hope of recovering money and for the second time he falls victim to fraud.
What is the direction of scamer attacks on Poland?
Due to the geographical location and language issues, the so -called The boiler rooms from which telephone connections are made to Poland are often located in Central and Eastern Europe.
Are these criminal gangs or are they also involved in the activities of fraudsters?
In the case of some countries with limited democratic standards, it cannot be ruled out that criminal groups operate with a quiet resort or support from local state structures. However, this usually applies to disinformation activities, not directly participation in financial fraud. In the overwhelming number of cases, organized criminal groups focused mainly on achieving profits are behind this type of activity. As I mentioned, they often have a structure that resembles commercial companies. You can easily find various types of job ads in this type of so -called boiler rooms. Our observations show that these groups most often show activity on business days, from Monday to Friday, from 8.00-16.00. From the perspective of many people involved in this type of fraud, their daily activities are not much different from ordinary office work – In the morning they come to the “office”, turn on the computer, burn coffee, send e -mails and make phones, as in typical work at a sales or service stand.
What about Christmas?
During the holiday season, both new domains and telephone connections are less. Before Christmas, however, there is a very high severity of fraudsters. These are not investment campaigns, but related to pre-Christmas purchases: SMSs regarding the underpayment to the package, etc.
Generally honest working conditions.
Only activities are dishonest.
How does artificial intelligence affect the how the fraudsters work?
Currently, AI is mainly used for manipulation using Deepfejk mechanisms. Virtually every day we see new and manipulated films in which a celebrity or a well -known person encourage false investments. We also have great concerns about the possible increase in the use of AI in BEC (Business Email Compromise) attacks aimed at companies. Earlier, the most commonly used method was to impersonate the president or financial director, leading to the takeover of the e -mail address and persuading an accounting worker to make a transfer. Currently, it is much easier to manipulate, for example, impersonating the president using the voice generated by artificial intelligence in order to influence the employee's actions.
False ads most often appear on internet platforms. There are many voices that they do not apply to the fight against fraud. They themselves argue that they do everything in their power.
In recent years, we have been consistently striving to develop increasingly effective communication channels with digital platforms. People who work in Polish branches of these platforms see the problem and try to fight it. In many cases, we have access channels, with which we can report harmful content, and these content is getting faster and more efficiently neutralized. However, the scale of this phenomenon is a significant problem. There are several dozen or several hundred new malicious ads for each advertising and blocked advertising. The question is whether the platforms undertake actions adequate to the level of danger, which is gradually increasing. Criminals have noticed that advertising is not only a very good trade lever, but also a very good lever of various types of fraud, so they use it widely. Using digital platforms.
Scamming Out! 2.0
Banker.pli “Puls Biznesu” for the second time they initiated the action Scamming Out! -Information and educational campaign, aimed at increasing the interest of society and decision-making factors with a growing scale of threat from cyber-suses. We invite you to track the campaign on both websites and on the website dedicated to our campaign: scammingout.pl
