# European bank phishing scams

> Live situation record from CLSTR: https://clstr.news/situations/european-bank-phishing-scams
> Updated: 2026-07-31T19:00:00.000Z. Sources: 9. Developments: 2.

On 29 July 2026, Polish cybercriminals launched coordinated phishing campaigns that spoofed retailer Lidl and PKO Bank Polski, sending fake collaboration invitations and malicious Excel attachments to businesses and consumers. Two days later, on 31 July 2026, a separate wave targeted customers of Dutch bank ING in Belgium, using urgent messages with countdown timers and prompting victims to call unknown numbers. Both incidents illustrate a widening pattern of phishing attacks on European financial institutions, prompting warnings from the affected banks and advice to verify sender details and avoid unexpected attachments. Analysts also noted a broader rise in cyber activity, including claims of attacks on safety‑critical systems, underscoring growing concerns about the use of deception to erode public trust.

## Timeline

### 2026-07-31: ING customers hit by phishing wave amid rising cyber attacks on safety systems

ING customers in Belgium face a phishing wave using urgent fake alerts, while experts note a shift toward cyber attacks that aim to undermine trust in safety systems, including alleged disruptions of Israeliair

2 sources. https://clstr.news/cluster/ing-customers-hit-by-phishing-wave-amid-rising-cyber-attacks-on-safety-systems

### 2026-07-29: Polish firms and bank customers hit by fake Lidl and PKO Bank phishing scams

Scammers in Poland are impersonating Lidl and PKO Bank in phishing attacks, sending fake collaboration offers and fraudulent operation confirmations with malicious Excel attachments, endangering company data &

7 sources. https://clstr.news/cluster/polish-firms-and-bank-customers-hit-by-fake-lidl-and-pko-bank-phishing-scams

---
Cite as: European bank phishing scams. CLSTR, https://clstr.news/situations/european-bank-phishing-scams