KSeF 2.0 Scams: Phantom Invoices, Fake Tax Office Emails and How to Protect Your Business

It's February 2026. Poland's National e-Invoicing System (KSeF) is now part of everyday business life, and "structured invoice" is the phrase on everyone's lips in accounting departments across the country. The Ministry of Finance (MF) has built a digital fortress designed to close tax loopholes and stamp out the shadow economy. And credit where it's due: the server infrastructure is solid, resilient to DoS attacks and built entirely on domestic technology.

The paradox is that when the walls can't be breached, criminals look for ways to get you to open the gate for them. The digital revolution in taxation has brought an unexpected side effect: a system meant to eliminate errors has become a new playground for social engineers and fraudsters who understand exactly how much people fear new, unfamiliar regulations.

Let's take a closer look at this new reality and the threats that come with mandatory use of KSeF 2.0.

1. The "Phantom Invoice" Paradox: A Document You Never Ordered

In the old world of paper and PDFs, things were simple: you got a suspicious email with an invoice, deleted it and forgot about it. If a document arrived by mail and didn't match any order, it went straight in the trash. In the world of KSeF 2.0, the rules of the game have changed dramatically.

The system is built on the principle that an invoice is considered issued and received the moment it is validated by the Ministry of Finance's system and assigned a unique KSeF number. This means a fraudster can issue an invoice using your details (your tax identification number, or NIP, is public information, after all), and it will automatically show up in your accounting system as a valid document.

Worse still, the system offers no way to "reject" an invoice. Once accepted, the document becomes part of the buyer's tax history. If your accounting team, swamped with thousands of transactions, overlooks a fake and books it, you could face allegations of complicity in VAT fraud or of documenting fictitious business transactions.

How do the fraudsters operate?

They use the "small amount" method. They issue hundreds of invoices for modest sums (e.g., PLN 150–200) for intangible services that are hard to verify: "IT consulting," "knowledge base access," "handling fee." They are counting on companies' automated booking processes to let these amounts through without additional approval.

Red flags to watch out for:

• An unknown counterparty who isn't in your vendor database.
• Suspicious links in the invoice's notes field (the XML format allows free-text notes – never click them!).
• No way to reach the issuer at the phone number provided.
• A service completely unrelated to your industry.

Remember: if you receive an invoice like this, your only line of defense is to report the abuse to the National Revenue Administration (KAS). This won't remove the invoice, but it does serve as evidence of your "due diligence."

2. Lethal Social Engineering: Email Spoofing and "Fake KAS"

The biggest hit of early 2026 has been attacks that exploit the authority of government agencies. Criminals know business owners fear penalties (even if those penalties are suspended during the transition period), so they are sending out mass messages that look strikingly similar to correspondence from the mf.gov.pl domain.

Attack scenarios:

• "Request for clarification": You receive an email supposedly from the head of your local tax office, claiming there are errors in your KSeF integration.
• "Synchronization error": A notice about a KSeF gateway outage, telling you to log in manually via the link provided to "unlock" your ability to issue invoices.
• "Overpayment refund": A classic ploy, this time dressed up as a VAT settlement under the new system.

All of these messages share a single goal: to get you to click a link that either infects your computer with malware (such as a keylogger) or redirects you to a fake login page (e.g., podatki-gov-pl.web.app), where you unknowingly hand your credentials over to the criminals.

Before you open an attachment or click a link, check these 4 points:

1. DOMAIN: Is it really the government?

Genuine emails only come from addresses ending in .gov.pl.

• ✅ Safe: kancelaria@mf.gov.pl, powiadomienia@podatki.gov.pl
• ❌ SCAM: ministerstwo-finansow@poczta.onet.pl, ksef-admin@mf-gov.pl (watch out for the hyphen instead of a dot!), biuro@ksef24.eu.

2. EMOTIONS: Is someone trying to scare you?

Fraudsters play on fear. If the email contains threats such as:

• "Your account will be blocked in 2 hours"
• "You have an unpaid invoice – PLN 5,000 fine"
• "Final notice to verify your account" ...it's 99% certain to be an attack. The tax office never sends threats like these by email. You'll find all official notices by logging in to the e-Tax Office (e-Urząd Skarbowy).

3. ATTACHMENTS: Don't download "ZIPs"

The Ministry of Finance does not send free software, instructions in .zip format or payment demands as .doc files.

• If an email urges you to download a "certificate update" or a "new KSeF app" from an attachment – DON'T CLICK. It's malware.

4. LINKS: Check where they lead

Hover your mouse over the link (don't click!).

• If you see a strange string of characters (e.g., bit.ly/ksef-login or ministerstwo.hosting123.pl), do not go there under any circumstances.
• Log in to KSeF only by typing the address into your browser manually.

3. The QR Code: Your Beacon in the Dark

Many suppliers still send invoices by email as PDFs (a so-called visualization of the structured invoice). Keep in mind: legally, this isn't the document itself, just a "picture" of it. Every such PDF must carry a printed QR code.

This is your simplest verification tool. Unsure about a document? Scan the code with the official taxpayer app.

• If the code takes you to the official Ministry of Finance gateway and you see the same details as on the printout, the document is safe.
• If the code doesn't work, leads to a suspicious website or the details don't match, you are most likely holding a forged document that never entered KSeF and was created solely to trick you into making a bank transfer.

4. The MCU Module and the Outsourcing Trap

If you thought your banking password was important, take a look at the Certificates and Permissions Module (MCU). This is where tokens and permissions to issue invoices on your behalf are managed.

The Accounting Firm Risk

It's tempting to give your accountant "all permissions" just for "peace of mind." That's a mistake. If your accounting firm falls victim to an attack (a supply chain attack) and you've given it unrestricted access, hackers gain access to your finances.

Remember: You, as the taxpayer, are responsible for what happens in your KSeF account, not your accounting firm.

• Never share your administrative token with anyone.
• Grant permissions precisely (e.g., invoice issuing only, without viewing rights, or vice versa).
• Require your accounting firm to use two-factor authentication (2FA).

5. The "Safety Guide" and "Auditor" Scams: Creativity Knows No Bounds

Criminals adapt quickly. In February 2026, the Ministry of the Interior and Administration (MSWiA) warned of a "Safety Guide" scam. The mechanism is simple: fraudsters call or write to companies offering "mandatory" training materials or "required certification" of KSeF 2.0 compliance.

They demand fees for "express shipping" of free government brochures or try to book a visit from a "certified auditor" who supposedly needs to inspect your systems. In reality, the goal of such a visit may be to gain physical access to your accounting department's computers or to extract passwords in a "one-on-one" meeting.

Remember: Official government guidance and materials are always free. Anyone who asks for money for "access to KSeF instructions" or wants to "verify passwords for synchronization" is a scammer.

6. Are You Ready for the Maturity Test?

For Polish businesses, 2026 is a major test – less of accounting than of digital hygiene and security procedures. KSeF is a powerful tool that will speed up cash flow and close tax loopholes, but only if we learn to view our financial systems as a front line in the fight for data security.

The weakest link in the KSeF chain isn't the Ministry's servers – it's us: our carelessness when reading email, our failure to verify counterparties and our tendency to hand out IT system permissions far too freely.

Aleksander

FAQ

Can I reject an invoice in KSeF that I don't recognize?

No, the system has no "Reject" button. Once an invoice is assigned a KSeF number, it is considered delivered. However, you are not required to book it or pay it. Your obligation is to report the abuse in the system to notify the tax authorities of the attempted fraud.

I clicked a link in a suspicious email but didn't enter anything. Am I safe?

Not necessarily. Simply visiting the page may have triggered a malware download (a so-called drive-by download). Disconnect your computer from the network immediately, scan it with a reputable antivirus program and change your banking and KSeF passwords (using a different, secure device).

Is my accounting firm liable if someone breaks into their account and issues fake invoices in my name?

Legally, responsibility for tax settlements always rests with the taxpayer. You can seek damages from the firm through civil proceedings, but when it comes to the tax office, you will be the one who has to provide explanations and file corrections. That's why it's so important to work only with firms that maintain high cybersecurity standards.

I received a PDF invoice by email from a regular supplier, but it has no QR code. Is that a mistake?

Since KSeF became mandatory, every visualization of a structured invoice shared outside the system (e.g., by email) must include a QR code. A missing code is a warning sign – call the supplier to clarify the matter.