The digital transformation of public administration in Poland has become a reality. The times of visits to offices, paper applications and long queues are slowly becoming a thing of the past in favor of fast and convenient online communication. The key that opens the door to this digital world is the trusted profile. This is a free, state-certified tool that acts as our digital ID card. It allows us to unequivocally confirm our identity online, making it possible to handle hundreds of official matters without leaving home or the office.
The tremendous convenience and power that a trusted profile gives us - from filing a tax return to checking our medical history to signing an official letter to the government - also comes with a huge responsibility. Our digital identity has become an extremely valuable asset, and thus an attractive target for cybercriminals. Its theft, through phishing or malware, can have disastrous consequences - from taking out loans on our data to taking control of our business.
That’s why safe and informed use of a trusted profile is a key digital skill for every citizen and business today. This guide is designed to answer the twelve most important questions about this service in a comprehensive and accessible way. We will explain what exactly a trusted profile is, how to set it up and protect it securely, the risks associated with it, and good practices to follow both in private life and in a corporate environment.
Shortcuts
- What is a trusted profile and what opportunities does it provide in dealing with the administration?
- Why is using a trusted profile more secure than traditional methods?
- What are the most common digital identity risks and how to avoid them?
- How to set up and confirm a trusted profile in a secure way step by step?
- How do I protect my trusted profile login information from theft?
- How is a trusted signature different from a qualified electronic signature?
- What to pay attention to when signing documents online to avoid falling victim to fraud?
- What are the best practices for managing a company’s digital identity?
- Can an employee be authorized to use the company’s trusted profile?
- How do you recognize a phishing attempt targeting your banking or trusted profile login information?
- What steps should we take if we suspect that someone unauthorized has accessed our profile?
- How can nFlo’s cyber security training help your employees securely manage their digital identities?
What is a trusted profile and what opportunities does it provide in dealing with the administration?
A trusted profile is, simply put, a free and legally sanctioned method of confirming a citizen’s identity in the electronic systems of public entities. It is a set of unique electronic data (such as first name, last name, date of birth and PESEL number) that is assigned to a specific person and allows him or her to authenticate credibly online. With it, government offices and other public institutions are assured that the person logging into their system is actually the person they claim to be.
The possibilities offered by having a trusted profile are vast and constantly expanding. It is a universal key to the entire ecosystem of Polish e-government. Among the most important applications are:
-
Logging in to public platforms: The trusted profile is the primary method of logging in to hundreds of services, such as ePUAP (Electronic Platform for Public Administration Services), PUE ZUS (ZUS Electronic Services Platform), IKP (Internet Patient Account), Ministry of Finance systems (e-Tax Office, Your e-PIT portal) or CEIDG (Central Register and Information on Economic Activity).
-
Submission of letters and applications: It allows us to electronically submit applications for ID cards, social benefits (e.g. 800+), register vehicles or report changes in company data.
-
Access to our own data: We can check our data collected in state records at any time, such as our medical history and e-prescriptions in IKP, our account balance with Social Security, or the number of penalty points.
-
Signing documents: The trusted profile allows the submission of a so-called trusted signature, which has the same legal force as a handwritten signature when dealing with public entities. It allows electronic signing of contracts, statements and official letters.
-
Setting up and running a business: With the help of a trusted profile, you can register a sole proprietorship fully online with CEIDG and handle most business matters.
📚 Read the complete guide: IAM / Zero Trust: Identity and access management - from the basics to Zero Trust
Why is using a trusted profile more secure than traditional methods?
While any digital tool carries certain risks, a trusted profile, used properly, offers a much higher level of security than traditional paper-based methods of doing official business.
First of all, it eliminates the risks associated with the physical circulation of documents. Paper applications can be lost in the mail, stolen or destroyed. The data on them can be suspected by unauthorized persons. In the case of electronic communication, confirmed by a trusted profile, we are assured that our application has gone directly into the authority’s system, and we receive an Official Certificate of Submission (UPP), which is indisputable proof of this.
Compared to simple login systems based only on a username/password pair, a trusted profile is inherently much more secure because its authentication mechanism is based on two-factor authentication (2FA). To log in, it is not enough to know the password alone. It is also necessary to have a second, dynamic component - most often a one-time authorization code sent via SMS to a verified phone number or confirmation of operations in the bank’s mobile app. This makes it significantly more difficult for unauthorized people to take over the account, even if they manage to steal our password.
What’s more, the process of confirming identity when setting up a profile, carried out by trusted entities such as banks or government offices, provides a much higher level of confidence in a user’s identity than a simple registration on any online service.
What are the most common digital identity risks and how to avoid them?
Despite robust technological safeguards, the weakest link in the digital identity security chain still remains the human being and his vulnerability to social engineering techniques. Some of the most common threats to be alert to include:
-
Phishing: It’s the number one threat. Cybercriminals create fake websites that deceptively resemble official government portals or bank login pages. Then, using carefully crafted email or SMS messages, they try to get the victim to go to such a site and enter their login information.
-
Malware: Installing malware such as a keylogger (which records keystrokes) or spyware on a computer or phone can lead to the theft of passwords and other sensitive data directly from our device.
-
Social engineering: Attackers may try to contact us by phone or instant messaging, pretending to be employees of a bank, government office or courier company. The purpose of such a call is to get us to enter a password, SMS code or install a supposedly “necessary” application, which in reality is malware.
-
Phone number hijacking (SIM Swapping): This is a more advanced technique that involves tricking a mobile operator into duplicating our SIM card. With this, the attacker takes over our phone number and is able to receive all SMS authorization codes, allowing him to take control of our trusted profile and bank accounts.
Avoiding these risks requires, above all, vigilance, skepticism and the application of basic digital hygiene principles, which we will discuss later.
How to set up and confirm a trusted profile in a secure way step by step?
The process of setting up a trusted profile is simple and can be done in several ways. The key is to always initiate the process from the official government website: pz.gov.pl. Never set up a profile by clicking on a link received in an email or SMS message.
-
Method 1: Through electronic banking (fastest and most convenient). This is the recommended method for most users. If you have an account with one of the banks that offer this service, you can set up a trusted profile within minutes, without leaving home. All you have to do is log into your online banking system, find the appropriate option (usually in the e-Government or Services section) and follow the instructions. The bank, which has already verified our identity when we set up the account, simply confirms our data in the government system.
-
Method 2: With video verification with an official. If we don’t want to or can’t use banking, we can fill out an application online at pz.gov.pl and then schedule a short video interview with an official. During the interview, we will have to show our ID card to the camera to confirm our identity.
-
Method 3: With confirmation at a stationary point. We can also fill out an application online, and then within 14 days go in person with an ID card to one of the thousands of Confirmation Points throughout Poland. Such points are located in tax offices, ZUS branches, municipal offices or post offices.
Whichever method you choose, the key is to perform the entire process on your private, trusted and secure computer, using a secure network connection (preferably avoiding public, open Wi-Fi networks).
How do I protect my trusted profile login information from theft?
Protecting our digital identity is an ongoing process that relies on good habits and following basic digital hygiene principles.
-
Use a strong and unique password: The password for online banking (if we use it to log in to the trusted profile) or the password directly to the trusted profile account must be absolutely unique - not used on any other service. It should be a long phrase (known as a passphrase), consisting of several words, easy for us to remember, but very difficult for attackers to guess.
-
Protect your second authentication component: SMS codes or notifications in the bank’s mobile app are the key to your profile. Never, under any circumstances, share them with anyone or enter them on sites you are not completely sure about.
-
Be skeptical and verify: Always carefully check the website address in your browser bar before entering any login information. Official government websites in Poland always end in .gov.pl. Don’t trust emails and text messages that pressure you for time and threaten to block your account.
-
Secure your devices: Regularly update the operating system, web browser and antivirus software on your computer and smartphone. Don’t install software from unknown sources.
How is a trusted signature different from a qualified electronic signature?
In the context of digital document signing, two terms often appear: trusted signature and qualified electronic signature. Although both are used to make statements of intent in electronic form, their legal force, application and nature are quite different.
- The trusted signature is inseparable from the trusted profile and is a free service. Its legal force, according to Polish regulations, is equal to a handwritten signature, but only in contacts with public entities (that is, in official and administrative matters). This means that we can effectively use it to sign an application to the municipality or a declaration to the Social Security Institution, but, as a rule, we cannot use it to conclude a valid business contract with another company or sign a notarial deed.
- Qualified Electronic Signature (QES) is a commercial service provided by certified private trust service providers. According to the EU eIDAS regulation, it has the legal force equivalent to a handwritten signature in all EU member states and in all contexts - both official and civil law (business). It is the highest and most universal form of electronic signature. It is usually issued on a special cryptographic device (card and reader or USB token) or in cloud-based form.
In summary, a free trusted signature is all that is needed to do business with government offices. For doing business and entering into commercial contracts electronically, a commercial qualified electronic signature is required.
What to look for when signing documents online to avoid falling victim to fraud?
The process of submitting a trusted or qualified signature is a high-risk moment that cybercriminals may try to exploit. Special vigilance should be exercised here. Always, before entering the authorization code from the SMS or confirming the operation in the application, we must perform two key actions.
First, carefully check the address (URL) of the website you are on. We must be absolutely sure that it is an official signature service website (e.g., belonging to ePUAP or our qualified signature provider) and not a fake phishing site.
Second, and most importantly, you should carefully read the content of the document or the digest (hash) of the document displayed on the signing page. This is the last moment we can verify what we are actually signing. Attackers may use techniques in which they show us one innocuous document for review, but in the signing process they “swap” it for another, such as a loan agreement or power of attorney. That’s why verifying the title and abbreviation of the document just before signing is absolutely crucial.
What are the best practices for managing a company’s digital identity?
Transferring the topic to the corporate environment, managing employees’ digital identities becomes part of organizational governance and risk management. It is necessary to implement clear policies and procedures.
A company should have a formal security policy that defines the rules for using company digital assets and representing the company online. Separation of private and business identities is key. An employee’s private trusted profile should never be used to handle company matters unless he or she has been formally authorized to do so.
The most important element is authorization management. A company must keep a record of all employees who are authorized to act on its behalf in e-government systems. A formal process should be implemented for granting and, critically, revoking these authorizations, especially when an employee’s relationship with the company ends.
Can an employee be authorized to use the company’s trusted profile?
This is one of the most common questions and the source of many misunderstandings. It should be stated clearly and emphatically: there is no such thing as a “corporate trusted profile”. By definition, a trusted profile is a service assigned to a specific individual and his PESEL number. It is inextricably linked to that person’s identity and cannot be “shared” or “transferred.”
The practice of a CEO providing his assistant with the login and password to his trusted profile so that he can handle company matters is extremely dangerous, illegal and a huge security breach.
The correct and secure process looks quite different. A company, as a legal entity, has its own account on platforms such as ePUAP or PUE ZUS, linked to its KRS or NIP number. The person authorized to represent the company (e.g., a member of the board of directors) logs into these systems using his or her own personal trusted profile, acting on behalf of the company. Then, inside a given system (e.g. on biznes.gov.pl), he or she can grant an electronic power of attorney (authorization) to a specific, named employee to handle a specific type of matter. Thanks to this, the employee, logging in with his or her own trusted profile, will be able to act on behalf of the company, but only within the scope of the authorization granted. This is the only secure, auditable and legal method.
How do you recognize a phishing attempt targeting your banking or trusted profile login information?
Recognizing phishing is a key skill. Attackers use social engineering techniques to lull our vigilance. However, there are several “red flags” that should always light a warning light for us:
-
Sense of urgency and threats: Messages like “Your account will be blocked immediately!”, “An unauthorized transaction has been detected, click NOW to cancel it!” are designed to create panic and prompt hasty action.
-
Language errors: Many phishing campaigns are prepared by foreign criminals and contain grammatical errors, stylistic errors or strange-sounding wording.
-
Suspicious sender: Always check the exact email address of the sender. It is often very similar to the real one, but contains a minor typo or is sent from a different domain (e.g., zus.com instead of zus.gov.pl).
-
Suspicious links: Never click on links directly. Hover over them with your mouse cursor and check in the lower left corner of your browser where they actually lead. If the address is different from the link text or looks suspicious, it is definitely a scam.
-
Data request: No legitimate institution - neither a bank nor an office - will ever ask you for your full password, PESEL number or SMS code in response to an e-mail.
What steps should we take if we suspect that someone unauthorized has accessed our profile?
If we have even the slightest suspicion that our login information may have fallen into the wrong hands, we should act immediately.
-
Change your password immediately: This is an absolute priority. Immediately log in (if still possible) to your online banking or directly to your trusted profile and change your password to a new, strong and unique one.
-
Check activity history: After logging in, carefully check the login history and the list of signed documents and submitted applications on the ePUAP platform and other related services.
-
Temporarily suspend or cancel the profile: If we can’t log in or see suspicious activity, contact the official trusted profile hotline immediately to temporarily suspend or cancel the profile.
-
Report an incident: Any such incident should be reported to the national incident response team - CERT Poland. If a crime has been committed (e.g., phishing, incurring liabilities), you should also immediately file a report with the Police.
How can nFlo’s cyber security training help your employees securely manage their digital identities?
Technology and procedures are extremely important layers of defense, but ultimately the security of a digital identity is determined by people - their knowledge, habits and vigilance. Employees are the most common targets of social engineering attacks, and their mistake can open the door to the entire organization. That’s why investing in building a “human firewall” is one of the most effective methods of protection.
At nFlo, we understand that the key to real security is education. That’s why we offer comprehensive cyber security training programs that are tailored to the needs and realities of modern companies.
-
Security Awareness Training: We design engaging, real-world example-based training sessions for all employees. We teach in a practical and easy-to-understand way how to recognize threats such as phishing, how to create strong passwords, how to use the Internet securely, and how to protect your digital identity, both at work and in your personal life.
-
Advanced workshops for executives: We conduct dedicated workshops for managers and leaders to discuss best practices in access management, building secure policies and procedures, and incident response.
-
Controlled social engineering tests: our services also include conducting simulated, controlled phishing campaigns. They allow us to safely test and measure the real level of awareness and alertness of employees, and the results become the basis for further improvement of the training program.
Protecting your company’s digital identity depends on the knowledge and habits of every employee. Investing in their education is one of the most effective ways to protect against attacks. Contact nFlo experts to learn more about our cyber security training portfolio and build a culture in your organization where everyone is an informed guardian of company data.
Related Terms
Learn key terms related to this article in our cybersecurity glossary:
- Cybersecurity — Cybersecurity is a collection of techniques, processes, and practices used to…
- Cybersecurity Incident Management — Cybersecurity incident management is the process of identifying, analyzing,…
- NIST Cybersecurity Framework — NIST Cybersecurity Framework (NIST CSF) is a set of standards and best…
- Identity and Access Management — Identity and Access Management (IAM) is a set of processes, policies, and…
- Identity Management — Identity management (IdM) is the process of creating, managing, and controlling…
Learn More
Explore related articles in our knowledge base:
- Identity management in the digital age - A comprehensive guide
- API and Web Services Security: How do you effectively protect the digital bridges that connect your applications and data?
- Backup Microsoft Entra ID: Why Identity Protection Is Essential Today
- Identity and Access Management (IAM): who, what, where, when and why
- Two-Factor Authentication (2FA) - Why Use It and How to Implement
Explore Our Services
Need cybersecurity support? Check out:
- Security Audits - comprehensive security assessment
- Penetration Testing - identify vulnerabilities in your infrastructure
- SOC as a Service - 24/7 security monitoring
Cybersecurity for Your Industry
Learn more about cybersecurity in your industry:
Related topics
See also:
