PKO Bank Polski · AI used against the institution · severity 1 of 5
PKO Bank Polski, Poland's largest bank, warned customers in December 2025 of a "new modus operandi" in which criminals use artificial-intelligence tools to create fake bank employee ID cards, according to TVN24, Wprost and Cashless.pl. Per the bank's warning, a caller first tells the victim a loan has been taken out in their name; a second caller posing as a bank employee then sends the forged ID by SMS or email and pushes the victim to install remote-access software or move money to a so-called "technical account". PKO BP said its employees never send IDs or business cards by SMS or email and never ask customers to transfer money to protect it. mBank warned of the same scheme the following day. No loss figure has been disclosed.
Record last reviewed Oct 21, 2026 · Markdown
Date
Institution
PKO Bank Polski
Country
Poland
AI system
AI tools used to generate fake bank employee identity cards
AI?
Described as AI by the institution or regulator
The institution, a regulator or a court called the system AI.
Status
Confirmed by the institution
Severity
1 of 5
Impact
No number of affected customers or loss figure disclosed · PKO BP, which TVN24 says serves about 12 million customers, warned that the scheme aims to obtain account logins or money transfers to accounts controlled by criminals.
What happened?
On 9 December 2025 PKO Bank Polski published a warning about a "new modus operandi" by criminals, TVN24 reported. According to TVN24 and Wprost, the bank said criminals were using artificial-intelligence tools to create fake bank IDs, which they used to make themselves credible during phone calls. "Criminals are impersonating our employees and using fabricated documents to gain customers' trust," the bank said, according to TVN24; the aim was to take over account login details or persuade the customer to transfer money to a so-called technical account.[1][2]
Per the bank's warning as reported by TVN24 and Wprost, the scam usually ran in several steps: the customer received a call about a loan supposedly taken out in their name; a second person posing as a bank employee then offered to help secure the account and sent a fake bank ID to appear credible; the caller then suggested installing remote-control software or moving money to a "technical account".[1][2]
Cashless.pl reported that the warning on PKO BP's website described the fake employee ID as generated with the help of artificial intelligence, and that mBank warned of similar attacks at a press conference the following day. Cashless.pl noted that a forged ID could carry the details of a real adviser, which defeats the usual check of calling the bank's helpline to verify the name.[3]
PKO BP's current guidance on fake calls from the bank, dated 15 April 2026, still warns that fraudsters may send a fake bank ID by SMS or email, shows an example, and tells customers to verify a caller's identity through a notification in the bank's IKO mobile app. That page does not mention AI. The OECD AI Incidents Monitor also indexes the December 2025 reports.[4][5]
When did it happen?
- Dec 9, 2025
PKO BP warns customers that criminals are using AI tools to create fake bank employee IDs; TVN24 reports the warning.[1]
- Dec 10, 2025
Wprost and Cashless.pl report the warning; mBank warns of a similar scheme at a press conference.[2][3]
- Apr 15, 2026
PKO BP's guidance on fake bank calls continues to warn about fake bank IDs sent by SMS or email and promotes caller verification in the IKO app.[4]
What was the impact?
- Customers: No number of affected customers or loss figure disclosed[1][2]
- Other: PKO BP, which TVN24 says serves about 12 million customers, warned that the scheme aims to obtain account logins or money transfers to accounts controlled by criminals.[1][2]
Severity 1 of 5: An impersonation technique flagged by the bank itself; no loss figure, number of affected customers or regulatory consequence has been disclosed.
How did PKO Bank Polski respond?
PKO BP said its employees never send IDs or business cards by SMS or email, never ask customers to install applications and never ask them to transfer money to secure it. It told customers not to give login details, BLIK codes, card data or full personal data over the phone, and to end any call that raises doubts. It later directed customers to verify callers through its IKO app.[1][2][4]
What was the outcome, and did regulators act?
The bank issued a public warning and continued to publish guidance on fake bank IDs and caller verification. No regulatory, police or court action specific to the AI-generated IDs has been reported.[1][4]
How did the PKO BP fake employee ID scam work?
Per PKO BP's December 2025 warning, a first caller claims a loan was taken out in the customer's name, then a second caller posing as a bank employee sends a fake ID by SMS or email and pushes the customer to install remote-access software or transfer money to a "technical account".
Did PKO BP say the fake IDs were made with AI?
Yes. TVN24, Wprost and Cashless.pl all reported that PKO BP's warning said criminals were using artificial-intelligence tools to create the fake bank IDs. The bank's later April 2026 guidance on fake calls shows a fake ID but does not mention AI.
Was any money lost to the AI-generated PKO BP IDs?
No loss figure or count of affected customers has been disclosed. PKO BP's warning described the aim as stealing login data or getting victims to transfer money, but neither the bank nor the reporting outlets published a total.
How can a PKO BP customer check that a caller really works for the bank?
PKO BP says its staff never send IDs by SMS or email or ask customers to move money. It tells customers to ask the caller to verify through the IKO app, which shows the employee's details in a notification, and to hang up and call official numbers if the details do not match.
- "Nowy sposób działania" oszustów. Największy bank w Polsce ostrzega news
- Oszuści z AI na celowniku PKO BP. Jedna rozmowa może opróżnić konto news
- mBank i PKO ostrzegają przed nowym schematem oszustw na fałszywe legitymacje pracownika generowane przez AI news
- Dzwoni „telefon z banku” – czy na pewno? official
- AI-Generated Fake Bank IDs Used in Fraud Targeting Polish Bank Customers incident index
When AI goes wrong at a bank, the next morning's brief says so.
when one of these regulators moves, the next morning's brief says so · six sourced stories · 7 am PT · free
plus every regulation, bank and agent page update, the morning after · leave any morning