CERT Polska: fake KAS 'JPK_VAT discrepancy' emails lead to webmail credential phishing
CERT Polska warns of emails impersonating Poland's tax authority (KAS) that claim JPK_VAT discrepancies and link to a fake webmail login page.
- First reported
- Reports
- 1
Source: x.com · published
What happened
On October 15, 2026, CERT Polska warned on X of another phishing campaign in which criminals impersonate Poland's National Revenue Administration (Krajowa Administracja Skarbowa, KAS). The emails claim that an automatic check of the recipient's JPK_VAT file found discrepancies in tax data, warn that ignoring the message may lead to sanctions, and urge the recipient to log in with their email account to access a tax portal. A sample published by CERT Polska shows the sender name 'Krajowa Administracja Skarbowa' with the sending address bucuresti@rac74.ro, the subject 'Nowe pismo w e-Urzędzie Skarbowym' and Ministry of Finance branding. CERT Polska's screenshot shows the link leading to a fake Roundcube webmail login page on a subdomain of carinehutsebaut.com, designed to capture the recipient's email password. The sending address and the long-registered carinehutsebaut.com domain may belong to compromised third parties rather than to the scammers themselves. KAS and the Ministry of Finance are being impersonated and are not involved.
How the scam works
CERT Polska describes the lure as alleged discrepancies found during an automatic check of the recipient's JPK_VAT file. Tax messages demanding an immediate response create pressure, and the link leads not to a tax service but to a page imitating an email login panel, so the 'tax portal' step is really a way of harvesting email passwords.
CERT Polska advises caution with tax messages that demand an immediate reaction, checking the sender's address and the address of the page the link opens, and verifying anything doubtful directly with your tax office.
Source
CERT Polska on X (@CERT_Polska), post of October 15, 2026.
Red flags
- A tax email from an address that isn't a government domain (here a .ro business address).
- Threats of sanctions over JPK_VAT discrepancies.
- A link that asks you to log in to your email account to see a tax letter.
If you were targeted
- 1Don't click the link or enter your email password.
- 2Check messages from the tax office by logging in to e-Urząd Skarbowy yourself, or contact your tax office directly.
- 3If you entered your password, change it immediately and turn on two-factor authentication.
- 4Report similar messages to CERT Polska at incydent.cert.pl or via the 'Bezpiecznie w sieci' service in the mObywatel app.