KSeF (National e-Invoicing System) brings new challenges for the security of business transactions. As invoicing becomes digital, new opportunities for abuse and tax fraud appear. Taxpayers need to be aware of the risks of receiving invoices from unreliable business partners and know how to act in such situations.
The e-invoicing system has been mandatory since 1 February 2026 for taxpayers whose sales including tax exceeded PLN 200,000,000 in 2024, and since 1 April 2026 for all other taxpayers (Article 145l of the VAT Act), which means that dealing with invoices from fraudsters in KSeF affects practically every business. Until 31 January 2026 the system was voluntary, and transitional rules still apply in 2026 (Article 145m), which makes checking business partners and exercising due diligence all the more important.
A structured invoice in KSeF is deemed issued on the day it is sent to the system, which means the document enters legal circulation with the date of sending. This rule may be abused by dishonest businesses, so it is particularly important to exercise due diligence when checking business partners
How KSeF works
KSeF is an electronic platform run by the Head of KAS (National Revenue Administration), who acts as the controller of the data in the system. A structured invoice, commonly called an e-invoice, is a document confirming a transaction subject to VAT, issued through the electronic interface within KSeF.
Various categories of entities may use KSeF (Article 106nb of the VAT Act), and since 2026 issuing structured invoices has been an obligation for taxpayers. Authorised users include taxpayers, entities designated by them, the entities referred to in Article 106c of the VAT Act, natural persons designated by those entities, natural persons granted permissions to use the system and other entities designated by natural persons using KSeF.
Until the end of January 2026, receiving structured invoices through KSeF required the recipient's consent. Since 1 February 2026 taxpayers receive structured invoices in KSeF without consent, and invoices are made available in an agreed way, for example by email, only to the buyers listed in Article 106gb section 4 of the VAT Act, including consumers and foreign entities without a fixed establishment in Poland
An important issue is when an invoice is deemed issued. Under Article 106na section 1 of the VAT Act, a structured invoice is deemed issued on the day it is sent to KSeF (for invoices issued in offline mode, the issue date is the date shown on the invoice – Article 106nda section 10). This means the document enters legal circulation as soon as it is entered into the system, whether or not the recipient has downloaded it.
Issuing a structured invoice does not require the buyer's consent. Since 2026 it is the seller's obligation, and the buyer receives the invoice in KSeF regardless of whether it ordered the goods or services. This rule simplifies document flow, but it may also be exploited by dishonest businesses.
Risk of fraud in KSeF
Treating an invoice as issued automatically when it is sent to KSeF creates new opportunities for abuse. Fraudsters may use this rule to issue fictitious invoices that formally have the status of documents in legal circulation. Businesses that establish trading relationships online, where checking a business partner is more difficult, are particularly exposed to such practices.
The KSeF rules do not set out detailed procedures for dealing with an invoice received from a fraudster. Taxpayers have to rely on established business practice regarding due diligence and acting in good faith. The lack of precise guidelines may lead to legal uncertainty and problems with settling VAT.
Even after mandatory e-invoicing was introduced, the Act does not provide a specific procedure protecting honest businesses against invoices from fraudsters. Taxpayers have to rely on established business practice regarding good faith and due diligence in trading relationships
Fraud in KSeF can take various forms. Examples include issuing invoices for non-existent goods or services, impersonating existing companies, setting up fictitious businesses solely to issue false invoices, or using stolen KSeF access credentials.
Situations where fraudsters use the details of genuinely existing companies to issue fictitious invoices can be particularly problematic. In such cases checking the business partner may be difficult, because the entity's formal details will be correct and the problem will only come to light when the transaction is performed or during a tax audit.
Due diligence principles in VAT
The concept of due diligence in VAT was developed by the case law of the Court of Justice of the European Union (CJEU) and the Polish administrative courts. Under Article 86 section 1 of the VAT Act, a taxpayer has the right to deduct input VAT on expenditure on goods or services used for taxable transactions.
However, the right to deduct input VAT must not be abused or used to obtain tax fraudulently. The CJEU has repeatedly held that the right is not available to a taxpayer where it is established on the basis of objective evidence that the taxpayer knew or should have known that the transaction was connected with VAT fraud (judgment of 6 July 2006 in joined cases C-439/04 and C-440/04 Kittel and Recolta Recycling).
It is the tax authority that must show, on the basis of objective evidence, that the taxpayer knew or should have known about the fraud (CJEU judgment of 21 June 2012 in joined cases C-80/11 and C-142/11 Mahagében and Dávid). In practice, however, the taxpayer should be able to document the due diligence it exercised in dealing with its business partner. If the tax authority shows a lack of due diligence, it may challenge the deduction of input VAT on the grounds that the transaction was made with an unreliable business partner
Tax authorities may not, however, require taxpayers to take excessive steps to exercise due diligence. The burden of checking whether a business partner settles its taxes correctly cannot be shifted to taxpayers. This follows from the principle that it is the tax authorities that are responsible for carrying out the necessary checks on taxpayers to detect irregularities.
In its judgment of 21 February 2017 (I FSK 1679/16) the NSA (Supreme Administrative Court) held that tax authorities may not, as a general rule, require a taxpayer wishing to exercise the right to deduct VAT to examine a range of matters concerning the invoice issuer. The taxpayer cannot be required to check whether the issuer is a taxpayer, whether it holds the goods concerned, whether it is able to deliver them and whether it complies with its obligation to file returns and pay VAT. Booking purchase invoices and preparing VAT returns is everyday work for our accounting firm in Warsaw.
Practical aspects of checking business partners
When establishing trading relationships online, the question of the required level of diligence is particularly important. In its judgment of 23 December 2016 (I FSK 522/15) the NSA held that email contact with a potential business partner does not in itself prove a lack of diligence on the part of the taxpayer, because this form of communication is common in business.
The court stressed that the lack of a written contract between the parties, the lack of personal contact and reliance solely on documents accepted uncritically by email to confirm the formal existence of the business do not necessarily indicate a failure to exercise due diligence. This position is particularly relevant at a time when business contacts are increasingly digital.
Email contact with a business partner does not in itself prove a lack of diligence on the part of the taxpayer – diligence is assessed on the basis of all the circumstances of the transaction. The lack of a written contract, the lack of personal contact or reliance on documents received by email do not automatically mean a failure to exercise due diligence
The basic steps a taxpayer should take as part of due diligence include:
- Checking the business partner's details in publicly available registers
- Checking the partner's VAT status in the list of VAT taxpayers – the VAT taxpayer white list (Article 96b of the VAT Act) – and, for EU partners, in the VIES system
- Confirming the partner's identity by phone or email
- Checking whether the terms of the transaction, including price and payment terms, are reasonable
- Documenting the checks carried out
Checking a business partner should not, however, impose an excessive control burden on the taxpayer. The taxpayer is not required to carry out a detailed analysis of the partner's financial position or to check its commercial reliability beyond standard business practice.
Settling an invoice from a fraudster in KSeF
When the seller sends an invoice to KSeF, the document enters business circulation because it is deemed issued. However, the mere fact that an invoice is in KSeF determines neither the right to deduct nor the buyer's good faith. An invoice recording transactions that did not take place does not give the right to deduct (Article 88 section 3a point 4 letter a of the VAT Act) – for such "empty invoices" good faith is not examined at all (NSA judgment of 23 December 2016, I FSK 522/15), and where the irregularity resulted from the deliberate action of the taxpayer or of its business partner of which the taxpayer was aware, the additional tax liability is 100% (Article 112c). Due diligence matters where the goods or services were actually supplied but the invoice issuer turned out to be unreliable.
The key question when an e-invoice is issued by a fraudster is whether the recipient of the invoice exercised due diligence. A taxpayer acting with due diligence, who could not have known that the transaction was connected with a VAT offence or abuse, cannot be deprived of the right to deduct the tax shown on the e-invoice.
To deprive a taxpayer of the right to deduct input VAT from disputed invoices, it must be objectively shown that the taxpayer knew, or by exercising due diligence could have known, that it was taking part in transactions constituting tax fraud
In practice this means that a taxpayer receiving an invoice in KSeF should:
- Check the business partner's basic details before carrying out the transaction
- Check that the details on the invoice match the partner's details
- Confirm that the transaction took place with appropriate documents
- Keep records confirming the checks carried out
- If in doubt, contact the business partner to confirm that the invoice is genuine
Pay particular attention to situations where an invoice arrives without any previous business contact or concerns a transaction on unusual terms. In such cases a particularly thorough check of the business partner and the circumstances of the transaction is recommended.
What to do if you suspect fraud
If a taxpayer receives an invoice in KSeF and has reasonable doubts about whether it is genuine, it should take specific verification steps. The first step is to check the business partner's details in publicly available registers and to verify its VAT status.
If the suspicions about the partner's unreliability are confirmed, the taxpayer should:
- Contact the business partner to clarify the doubts
- Request additional documents confirming that the transaction took place
- Check whether the invoice was actually issued by the entity named on it
- Consult a tax adviser if there are serious doubts
- Consider notifying the tax authorities of the suspected fraud
Records of the verification steps taken are crucial in the event of a tax audit. The taxpayer should keep all evidence confirming that it acted in good faith and exercised due diligence.
Records of the verification steps are crucial in the event of a tax audit. The taxpayer should keep evidence confirming that it acted in good faith and exercised due diligence, including correspondence with the business partner and the results of checks in public registers
In particularly suspicious situations the taxpayer may consider holding back the VAT deduction until the doubts are cleared up. Although there is no legal obligation to do so, it may be justified in cases of obvious attempted fraud.
Responsibility of the tax authorities
According to the case law of the CJEU (including the judgment in cases C-80/11 and C-142/11 Mahagében and Dávid) and of the administrative courts, it is for the tax authorities to carry out the necessary checks on taxpayers in order to detect VAT irregularities and breaches of the law. These authorities are also responsible for penalising taxpayers guilty of irregularities or breaches.
This means that the burden of detecting tax fraud lies primarily with the tax administration, not with taxpayers. Taxpayers must exercise due diligence, but they cannot be burdened with excessive control obligations towards their business partners.
In the context of KSeF it is particularly important that the tax authorities develop effective mechanisms for detecting and preventing fraud. The electronic system creates new ways of monitoring transactions, but it also requires appropriate analytical tools and control procedures.
Comparison of fraud scenarios
| Type of fraud | Description | Detection methods | Taxpayer's action |
|---|---|---|---|
| Fictitious invoice | Document for non-existent goods/services | Checking that the transaction took place | Confirmation of delivery/performance |
| Impersonation | Use of an existing company's details | Contact with the genuine entity | Checking the partner's identity |
| Fictitious entity | Entity set up solely for fraud | Checking the registers | Checking the business activity |
| Stolen credentials | Use of someone else's access credentials | Monitoring KSeF | Reporting suspicions to KAS |
Practical tips for taxpayers
To minimise the risk of fraud in KSeF, taxpayers should introduce appropriate internal procedures. Basic security rules include regularly checking invoices arriving in the system, checking new business partners and documenting the checks carried out.
Pay particular attention to invoices with unusual features, such as:
- Very favourable prices compared with the market
- Short payment terms or a demand for payment in advance
- No way of contacting the business partner
- Inconsistencies in the partner's details
- Invoices for services that were not ordered
Practical example: A company received an invoice in KSeF for IT services from an unknown business partner. Before deducting VAT, it checked the partner's details in the REGON (statistical number) register, verified its VAT status and phoned the invoice issuer. Because the phone number was inactive and the company's address turned out to be fictitious, the company did not deduct the tax and notified the tax office (urząd skarbowy) of the suspected fraud.
It is also worth introducing two-step invoice verification, where every document is checked by two independent people. Such a system helps detect potential irregularities and reduces the risk of mistakes.
Preparing for mandatory KSeF
With mandatory e-invoicing in place since 1 February 2026 (for other taxpayers since 1 April 2026), businesses should keep refining their procedures. This covers not only technical aspects but also procedural and organisational ones.
The key areas include:
- Implementing suitable KSeF software
- Training employees in the new procedures
- Drawing up internal rules for checking business partners
- Preparing documentation of processes and procedures
- Establishing cooperation with tax advisers
Using mandatory KSeF should cover not only technical aspects but also procedures for checking business partners and staff training. It is particularly important to draw up internal rules on exercising due diligence
It is also worth monitoring legislative changes – the KSeF rules are still being supplemented, and from 1 January 2027 financial penalties will apply for issuing an invoice outside KSeF in breach of the obligation (Article 106ni of the VAT Act).
