Polish authorities have detained 12 people suspected of involvement in an international banking-fraud network, including two Russian citizens whom broadcaster RMF FM reports were flagged in security databases for possible contacts with terrorist organisations. Police have confirmed the arrests and the suspected financial crimes, but have not publicly verified the terrorism-related warnings.
The operation involved Poland’s Central Bureau of Police Investigation (CBŚP) and Central Bureau for Combating Cybercrime (CBZC), with support from the Internal Security Agency (ABW) and the police’s central counterterrorism unit, BOA.
In an official statement published on 12 October, CBŚP said the suspects were believed to have operated a fraud network using fast mobile payments and one-time transaction codes.
- Find more news from Poland on our Homepage .
The investigation is being conducted under the supervision of the District Prosecutor’s Office in Siedlce, eastern Poland.
Among those detained are nine Polish citizens, two Russian citizens and one Ukrainian citizen. The group comprises eight women and four men, aged between 21 and 57.
Seven suspects have been placed in pre-trial detention for three months following court decisions. The other five remain subject to police supervision.
Security warnings concerning two Russian suspects
The additional security-related information was reported by RMF FM journalist Krzysztof Zasada on Monday.
According to his investigation, the two Russian nationals were detained in Warsaw and had been living in Poland under temporary residence arrangements, one for approximately two years and the other for about a year.
RMF FM reported that both individuals had entries in security databases warning of possible contacts with terrorist organisations.
The broadcaster did not identify the organisations concerned or establish whether the alleged contacts had been independently confirmed.
Neither CBŚP nor CBZC mentioned terrorism-related warnings in their published accounts of the operation.
The authorities have also not announced any terrorism-related charges against the suspects.
The involvement of Poland’s domestic security agency and counterterrorism police unit does not, by itself, establish that the alleged banking-fraud operation was connected to terrorism.
The precise nature and significance of the reported security warnings therefore remain unclear.
How the suspected fraud network operated
According to Poland’s cybercrime police unit, the alleged criminal network had been active since 2024, operating in Warsaw, Łódź, Białystok and other Polish cities.
Investigators suspect members of the group of impersonating employees of banks and online marketplaces to persuade victims to provide one-time payment codes.
The scheme allegedly exploited BLIK, a widely used Polish mobile-payment system that allows customers to make purchases and withdraw money using temporary codes generated in their banking applications.
BLIK itself is a legitimate payment service. The suspected fraud relied on deceiving users into authorising transactions that benefited criminals.
The payment operator’s own security guidance warns customers against sharing codes with other people and advises them to verify the details of any transaction before approving it.
Police believe the suspects used these methods as part of an organised operation rather than a series of unrelated scams.
Conflicting estimates of financial losses
The scale of the alleged fraud remains uncertain.
In their published statements, Polish police put the preliminary losses identified by investigators at approximately PLN 250,000.
However, RMF FM reported, based on Zasada’s findings, that the suspects were responsible for fraud involving at least several million złoty and that their daily proceeds could reportedly reach PLN 200,000.
The substantial difference between these figures has not been publicly explained. It is unclear whether they reflect different accounting periods, additional suspected transactions or different assessments of the network’s activities.
Separately, police confirmed that investigators had seized cash in Polish and foreign currencies, jewellery and vehicles with a combined estimated value exceeding PLN 850,000.
The value of seized property is not the same as the amount of money proven to have been obtained through fraud.
Further arrests expected
Police said the investigation remained active and that further arrests were planned.
Those detained face potential prison sentences of up to 12 years if convicted of the offences under investigation.
The operation was first described publicly by CBZC on 9 October, with CBŚP providing its own announcement on 12 October. RMF FM’s reporting on Monday added the previously unconfirmed information concerning the two Russian nationals.
Investigators have not disclosed the full structure of the alleged organisation or the identities of its suspected leaders.
The case now presents two separate questions for Polish authorities: establishing the full extent of the suspected financial crimes and clarifying whether the security alerts reportedly associated with the Russian detainees have any significance beyond the original database warnings.
