Europol-backed Polish investigation uncovers counterfeit passports, visas and residence permits marketed through websites and social media, with 42 suspects arrested across a multiyear inquiry.
WASHINGTON, DC, November 11, 2026 — A Polish Border Guard investigation into an international document-forgery network resulted in 42 arrests and the seizure of more than 12,000 counterfeit credentials, revealing how a suspected criminal enterprise combined physical production, online advertising and cross-border distribution.
The network, whose suspected members were Ukrainian and Belarusian nationals operating mainly in Poland and Ukraine, allegedly supplied fraudulent passports, visas, residence permits, identity cards and driver’s licenses, according to findings Europol released on Feb. 21, 2025.
Investigators said the operation generated substantial illegal proceeds and relied on websites and social media to attract customers, while authorities ultimately secured approximately 250,000 euros and examined activity associated with suspected money laundering and document trafficking.
The findings illustrate why police increasingly see forged identification as a problem beyond individual travelers, since networks can involve manufacturers, distributors, brokers and buyers operating in different places while relying on the apparent legitimacy of official documents.
A Border Encounter Opened a Multiyear Investigation
Polish Border Guards traced the investigation to a 2020 encounter at the Korczowa border crossing, where a foreign national presented a forged driver’s license, prompting officers to investigate possible connections to a wider document-production and distribution operation.
What began with one suspicious credential expanded under the supervision of prosecutors in Przemyśl, showing how conventional inspection can uncover organized activity when investigators look beyond the person who first presented a questionable document.
The inquiry developed over several years, with officers identifying suspected production sites, tracing distribution activity, and working with Europol to exchange intelligence on an alleged enterprise reaching customers across the European continent.
The chronology matters because authorities did not arrest all 42 suspects in one raid; the total reflects successive investigations and enforcement actions, culminating in December 2024 operations before Europol publicly summarized the case in February 2025.
Investigators Uncovered Factories in Katowice and Gdańsk
Polish officials said investigators discovered an illegal document-production facility in Katowice in 2021, where suspects allegedly manufactured fraudulent credentials and arranged delivery to buyers through international postal services rather than relying entirely on personal transfers.
Authorities identified a second suspected factory in Katowice in 2023, when officers seized printing equipment, official-style stamps, cash, and about 7,000 fraudulent documents while arresting two Ukrainian nationals allegedly involved in the operation.
Authorities also identified premises associated with the network in Gdańsk and recovered about 2,000 counterfeit documents that police said were ready for distribution, another indication that the operation involved several production or storage locations.
In 2024, investigators arrested an additional Ukrainian suspect in Kraków who was allegedly responsible for dispatching fraudulent documents to customers across Europe, extending their attention from production facilities to individuals linked to distribution.
The sequence of discoveries also matters for understanding organized crime investigations because production, storage and distribution activities can occur in different cities, while the evidence needed to establish whether those activities belong to one enterprise may emerge only gradually through repeated authorized inquiries.
The Final Raids Took Place in December 2024
The final coordinated enforcement action occurred on Dec. 3 and 4, 2024, when Polish officers arrested seven suspects, searched four locations and seized electronic devices, documents and payment cards potentially relevant to the criminal investigation.
Europol supplied operational coordination, analytical assistance and specialist support during the broader investigation, while the Polish Border Guard and national prosecutors retained responsibility for national enforcement measures and subsequent proceedings involving the accused individuals.
Across the full inquiry, authorities reported 42 suspects arrested, eight people placed in pretrial detention and more than 12,000 forged documents recovered, with approximately 1 million Polish zlotys in assets secured, roughly equivalent to 250,000 euros.
Those numbers describe cumulative investigative results rather than a single shipment or one day of police activity, and the reported document total includes several categories of counterfeit credentials, not exclusively forged international passport booklets.
Criminal Sellers Advertised as Legal Assistance Providers
Investigators said the suspected network promoted its services through websites and social media while presenting itself as a legal assistance provider, creating a misleading professional appearance that could attract individuals seeking official-looking identification or immigration paperwork.
Europol reported an advertised charge of approximately 1,500 euros per document, with potential customers directed toward a service operation that provided information about costs and payments before suspected fraudulent products were prepared for delivery.
Such marketing matters because a purported assistance provider can exploit confusion between legitimate administrative support and unlawful document manufacturing, although an online advertisement alone does not establish the criminal intent of everyone who encounters it.
For readers seeking lawful residence or identity services, the case highlights the importance of distinguishing genuine government issuance from a seller’s claims, since a professional-looking website cannot confer legal validity on a manufactured credential.
Digital Messaging Connected Sales With Physical Delivery
According to Europol, customers allegedly paid an initial deposit and later received photographs of completed documents through online messaging platforms, before being asked to remit the remaining balance and arrange receipt of the physical materials.
The documents were then allegedly dispatched through postal operators or handed over personally by members of the organization, linking internet-based customer communication with a real-world distribution system spanning national borders and several criminal participants.
This combination of online advertising and physical delivery illustrates how digital coordination can extend the reach of a local operation without replacing the physical production and transportation required for certain counterfeit credentials intended to resemble official government-issued documents.
Investigators nevertheless must establish which communications and transactions belong to particular suspects, because a recovered message or digital account does not automatically prove who controlled it or whether every advertised product reached a buyer.
Authorities did not disclose a verified inventory of every buyer or destination in the public summary, and the available figures do not show how many counterfeit documents employers, licensing offices, or immigration authorities accepted before investigators intercepted them.
A News Report Highlights the Commercial Scale
As TVP World reported on February 21, 2025, the alleged scheme combined online advertising, false claims of legal assistance and a documented police investigation that exposed production facilities and significant amounts of counterfeit identification.
The broadcaster described how the initial inquiry began after officials found a fake driver’s license in Korczowa, underscoring the investigative value of an ordinary border encounter that eventually revealed allegations involving numerous suspects and criminal services.
The account also reflects the need to interpret reported figures carefully, because 12,000 recovered documents cannot be equated with 12,000 verified customers or successful crossings, and advertised charges do not establish a complete accounting of criminal revenues.
Counterfeit Identification Threatened Several Administrative Systems
The seized materials reportedly included passports, visas, driver’s licenses, identity cards, and residence permits, each with different legal functions and subject to different authorities depending on the transaction or journey involved.
A counterfeit residence permit may be intended to misrepresent authorization to stay, while a fraudulent driver’s license can create risks in licensing or identification settings, and a forged passport can misstate citizenship or personal identity during travel.
Because these documents serve different purposes, investigators must avoid collapsing every recovered credential into the category of a fake passport, even when members of the same suspected organization produce several types of forgery.
Authorities also have to distinguish physically counterfeit identification from genuine documents obtained through deceptive applications, since the latter may contain legitimate security features while resting on inaccurate information accepted during an official issuance process.
The reported legal-assistance disguise adds a consumer-protection dimension because people unfamiliar with administrative requirements may struggle to distinguish authorized representatives from businesses making deceptive promises, especially when websites use professional language without any verifiable connection to an official issuing agency.
Financial Evidence Helped Reveal the Alleged Enterprise
Polish Border Guards said their extensive multiyear investigation uncovered suspected money laundering linked to document sales, making financial records and recovered assets as important as printing equipment, communication devices, and the counterfeit credentials themselves.
Authorities reported securing property and funds worth approximately 1 million zlotys, but that seized amount should not be treated as the network’s total revenue or profit because it represents assets identified and restrained during the investigation.
Carefully examining suspected financial relationships may help prosecutors determine whether individuals were involved in commercial document fraud, but payments alone cannot establish criminal liability without reliable evidence linking transactions to the alleged offenses.
The economic dimension matters because removing one counterfeit document from circulation does not necessarily disrupt a supplier’s ability to produce additional credentials, whereas investigations into organizers and supporting finances can address broader alleged criminal activity.
Cross-Border Cooperation Supported Polish Investigators
Europol said its specialists facilitated information exchange throughout the multiyear operation and provided expertise during action days, helping Polish authorities examine a suspected network whose operations and customer relationships crossed international boundaries.
The case demonstrates the practical importance of lawful cooperation when witnesses, communication records or suspected participants may be located in separate countries, each governed by different investigative powers and procedures for preserving usable evidence.
The U.S. State Department’s published investigative regulations similarly recognize passport fraud as a specialized investigative responsibility, showing how document offenses can require coordination among consular authorities, dedicated investigators, and other agencies.
Although Polish authorities led the case, the broader lesson applies internationally because counterfeit identification can be created in one jurisdiction, advertised through digital channels, and presented to institutions operating in another.
Digital records can be particularly useful when corroborated with recovered equipment, witness testimony, and financial evidence, but investigators must preserve their integrity and respect legal limits on accessing information held by service providers or individuals in other countries.
Modern Passport Security Creates Additional Verification Layers
Governments have strengthened modern passport books with specialized identity pages, laser personalization, optical effects, and electronic chips, giving trained inspectors more ways to distinguish authentic credentials from documents that merely resemble official designs.
As Amicus International Consulting’s guide to modern passport security explains, physical examination, chip authentication, and biometric comparison offer different kinds of evidence that must be evaluated together, not treated as interchangeable guarantees.
Electronically protected passport data can be checked against appropriate issuing-authority certificates when a document and inspection equipment support that process, but successfully displaying chip information does not equal validating its cryptographic signature.
These protections matter most when an alleged vendor claims a forged credential will be accepted universally, because appearance alone cannot show that a physical product meets current security requirements at international border checkpoints.
Digital Document Images Do Not Establish Authenticity
The reported practice of sending customers photographs before final payment illustrates how electronic images can become part of document sales, but a photograph does not establish that the underlying passport or identification card was officially issued.
Remote financial institutions and other regulated commercial organizations may encounter deceptive document images without access to the physical security features available during an in-person examination, creating a distinct identity-verification risk.
Even where a genuine credential contains a working electronic chip, authorities may still need to determine whether the person presenting it is the rightful holder, because successful authentication does not independently establish legitimate possession.
Protecting Legitimate Applicants Requires Clear Distinctions
Lawful immigration advice, name changes, and document replacement services differ from producing counterfeit credentials, and people seeking assistance should verify that the relevant government authority issues any promised official document.
Suspected customers in a criminal investigation may have different circumstances, including intentional participation, deception or exploitation, so individual responsibility must be established through evidence rather than inferred from a name appearing in marketplace records.
The Polish arrests and seizures describe investigative outcomes, while any defendant remains entitled to applicable procedural protections and should not be described as convicted merely because authorities announced the disruption of a suspected organization.
The investigation also shows why employers and other document recipients should understand the limits of visual inspection: a professionally presented credential can still contain fraudulent claims, while an unusual but genuine document should not automatically trigger accusations against its owner.
The Polish Case Shows Why Network Investigations Matter
The five-year inquiry illustrates how a seemingly limited encounter with a forged driver’s license can expose a much larger operation when authorities follow reliable evidence through suspected production sites, distribution activity and financial relationships.
For border security officials, the broader challenge is to detect suspicious documents while establishing whether they connect to suppliers whose activities may continue beyond the immediate seizure or the arrest of an individual presenter.
The reported disruption in Poland also underscores the value of precise public reporting, since dates, document categories and cumulative arrest figures provide necessary context for understanding what investigators actually established through successive enforcement operations.
Ultimately, the case shows why coordinated investigations, secure document issuance, and layered identity verification remain essential to protecting legitimate travel and public trust against organized attempts to manufacture and distribute fraudulent government credentials, especially when sophisticated commercial disguises make illegal services appear legitimate to unsuspecting customers.