Polish health fund NFZ targeted by sophisticated phishing scam
CERT Orange has warned of a new phishing campaign that impersonates Poland’s National Health Fund (NFZ) and targets patients. Emails bearing the NFZ logo claim a system failure has blocked medical reimbursements and ask recipients to verify personal data through a fake website.
The counterfeit site copies official government pages and solicits full credit‑card details, enabling fraudsters to empty victims’ bank accounts. CERT Orange stresses that neither NFZ nor the Social Insurance Institution ever request payment‑card information for refunds, which are always processed to a bank account declared by the patient via secure channels such as Profil Zaufany or the Internet Patient Account.
The alert advises users to verify domain endings (official sites end in *.gov.pl) and to avoid providing card data in response to unsolicited emails.