Unknown Invoice in Your KSeF: Scam Invoices and How to Report Them

A scam invoice can be issued inside KSeF and auto-assigned to your NIP. The system does not ask for your consent before assigning the invoice to your inbox. You discover it after the fact, when you check your KSeF inbox and find an invoice from a supplier you do not recognise, for goods or services you did not order.

This is a documented fraud vector. The invoice is valid in KSeF terms: it passed schema validation, received a KSeF number, and has a UPO. The fraudster used a valid NIP and token to issue it. KSeF authenticated the issuer. It did not verify that you have a business relationship with them.

What to Do

Step 1: Do not book the invoice

Do not record the scam invoice in your accounting. Do not deduct input VAT. Do not pay it. Booking it creates a tax exposure and legitimises the fraud.

Step 2: Contact the issuer

Look up the issuer's NIP on the biała lista. Contact them using the phone number or email from the registry, not from the invoice. Ask whether they issued the invoice. If they did not, they may be a victim of identity theft (someone used their NIP without authorisation).

Step 3: Use the "Zgłoszenie nadużycia" button

On 24 April 2026, the Ministry of Finance added a "Zgłoszenie nadużycia" (abuse report) button in Aplikacja Podatnika. Use it to report the scam invoice. The report flags the invoice in the KSeF system and notifies the tax authority.

Step 4: Document everything

Save screenshots of the invoice, the KSeF number, the UPO, and your communication with the issuer (if any). File a police report if the invoice includes a bank account (an attempted payment fraud).

Step 5: Check your session history

Review your KSeF session history for any unauthorised access. If someone issued a scam invoice to your NIP, they may also have accessed your account. Check for logins from unfamiliar locations or times.

Why KSeF Allows This

KSeF is a clearance system. It accepts any schema-compliant invoice from an authorised sender. The sender needs a valid NIP and a valid token. If a fraudster obtains or registers a NIP and generates a KSeF token, they can issue invoices to any buyer NIP. The system does not verify that a business relationship exists between issuer and buyer.

This is the same architectural gap that makes bank-detail substitution possible: KSeF checks form, not substance. The state verifies who issued the invoice. It does not verify whether the invoice reflects a real transaction.

Prevention

You cannot prevent scam invoices from arriving in your KSeF inbox. The system does not offer an opt-out or a whitelist. What you can do:

1. Check your KSeF inbox regularly. Do not wait for your accountant to find it during monthly reconciliation. Check weekly.
2. Set up notifications. Configure your invoicing software or Aplikacja Podatnika to send email or SMS notifications when a new invoice arrives in your KSeF inbox.
3. Train your accounting office. Make sure your biuro knows to flag unknown invoices immediately, not book them and discover the problem later.
4. Report every scam invoice. Even if the amount is small. Reports help the tax authority identify patterns and revoke fraudulent NIP registrations.

This material is information of a general nature and does not constitute legal or tax advice. For a specific situation, verify the current rules or consult a qualified adviser.