Security and identity protection — glossary

Notification service about specific events regarding credit and economic data, according to the scope of the selected package. It may help you notice unexpected activity related to your request.

In practice: The notification does not automatically block all fraud attempts. In the event of an unknown event, quickly contact the indicated institution. Alerts, PESEL reservation and document reservation are different tools that can complement each other.

Expressing consent to perform a specific payment operation in the manner agreed with the service provider. It may be done, for example, by means of a code, confirmation in the application or other mechanism allowed for a given payment.

In practice: Check the amount, recipient and purpose of the message before committing. Simply logging in to the bank does not mean consent to every transfer. The code or notification may also involve adding a recipient or changing settings, so read the entire content of the request.

A statement of household income and expenses, supplemented with liabilities and a savings plan. It allows you to estimate the safe level of the future installment.

In practice: Include annual bills, repairs, medical treatment and support for loved ones, not just everyday purchases. The loan calculator does not know all your needs. The surplus should also be sufficient in the event of an unfavorable scenario, e.g. a temporary drop in income.

Illegal use of someone else's data, e.g. to submit an application for financing. It may occur after the loss of a document, information leak or online fraud.

In practice: Upon detection of suspicion, contact the institution and appropriate authorities, secure accounts and retain evidence. Consider available holds and caveats. Don't treat every loan news as genuine without checking its source.

A list of the Polish Financial Supervision Authority including information on notifications of suspicion of certain crimes and related proceedings. It helps you check potential risks before using financial services.

In practice: Presence on the list does not constitute a final judgment. Lack of entry also does not guarantee safety. Check the exact name of the entity, description of the case, registers required for a given activity and data in the contract.

Fraud involving impersonating a trusted company or institution in order to extort data, codes or money. It may use email, SMS, telephone and fake websites.

In practice: Check the full domain address and authorization purpose. Do not approve an operation that you did not request, or install an application at the request of a random interlocutor. Clarify your doubts through the official contact you found yourself.

The name of the program and markings found in entrepreneurs' materials. A certificate or quality mark refers to the rules of a given program, not to a state guarantee of contract performance.

In practice: Check the issuer, validity and scope of the certificate. The logo on the website does not replace the analysis of company records, costs and data. It does not mean that every product of a given entrepreneur is safe or the most beneficial for the customer.

User verification using two different factors, e.g. password and device. In banking, regulations and procedures define the requirements for strong authentication and the situations in which exceptions apply.

In practice: Two slogans do not have to mean two independent factors. Additional confirmation reduces some of the risk, but does not prevent you from knowingly committing to a fraudulent operation. Don't provide caller codes or approve requests that you don't understand the purpose of.

Reporting the loss or risk of use of a document in an appropriate system, e.g. a bank's Restricted Documents system. It is intended to limit the possibility of using the document by an unauthorized person.

In practice: Restriction in the banking system, official invalidation of an ID card and restriction of the PESEL number have different purposes and procedures. When you lose your document, check the official services for the right steps. Simply finding a invalidated ID does not restore its validity.

A service that limits the risk of using your PESEL number to defraud certain financial services. Entities subject to the verification obligation check the status of the number before the indicated activities.

In practice: If you are entering into a contract that requires review yourself, you may need to temporarily lift the stipulation. Once you've finished the steps, you can turn them back on. This is a separate service from BIK alerts and ID document blocking.

Voluntary, specific, informed and unambiguous expression of will regarding the indicated processing of personal data.

Consent is one of the possible grounds for processing, and not a mandatory basis for every operation. Withdrawal of consent does not mean automatic deletion of data processed on another basis.

In practice: Separate marketing consent from data required to conclude or perform a contract.

Source: Personal Data Protection Office - consent to data processing.

A program or code used to harm the user, such as stealing data, intercepting information entered, or interfering with operations. It may reach the device via an attachment, a fake application or a dangerous file.

In practice: When banking and applying for loans, control the source of applications and their permissions. Update your system and do not install tools at the request of a random interlocutor. If you suspect your device has been compromised, contact your bank through another trusted channel.