The fresh agreement in mCitizen is simply a trap. 1 click and you give the fiscals an insight into your account!

Millions of Poles usage the mCitizen app all day, treating it as a digital wallet for papers and a gateway to e-government. However, the latest update from early 2025, making a seemingly insignificant change in the rules, includes a evidence that can revolutionize citizens' relations with the tax. Under the pretext of the “facilitation in accounts” and “integration into taxation systems”, the government introduced a mechanics that, upon consent, opens a gateway to our banking data to the taxation offices. Many users, by clicking "I accept" without reading a long and complicated text, could unconsciously give you unprecedented insight into your private finances. Cybersecurity experts and laws are beating the alarm, pointing out that this is simply a step towards full financial surveillance, which could have far-reaching consequences for each of us. What precisely does fresh consent mean, and what data will be sent to officials’ desks? We're analyzing this disturbing mechanism.

What is the “Integrated Payment Profile” and how did it get to mCitizen?

New functionality, officially named "Integrated Payment Profile" (ZPP), is straight linked to the full implementation of the National e-Faktur strategy (KSeF) in 2025. The government argues that in order to full automate and simplify the taxation settlement process, the State must be able to verify the financial flows of citizens. The ZPP is intended in explanation to automatically download data on incomes and expenses, which will let for the preliminary completion of the PIT declarations with unprecedented precision.

The problem is that this mechanics is based on standard Open Banking, i.e. the PSD2 Directive, which allows 3rd parties – in this case the taxation administration – to access information about our bank accounts. Until now, fintechs and banks themselves have mainly utilized this technology to offer fresh services. Now the state is entering the game, and the scale of the data collected is huge. Integrating this function with mCitizen, an application with almost mandatory status, makes the force to consent enormous.

A deal you might not have noticed. How does this mechanics work?

The process of accepting fresh conditions has been designed in a way that can lull user alertness. erstwhile the application is launched after the update, a message appears on the screen informing about "new possibilities" and "tax simplification". The long rules written in the legal language are rolled, and in the foreground there is simply a large button “I agree and I continue”.

Many users, accustomed to rapidly accepting the rules, click it without thinking. It is at this point that consent is granted to link their profile in mCitizen to the banking strategy and to supply data to the National taxation Administration. Importantly, consent is formally voluntary, but its deficiency of acceptance may in future limit access to key e-services specified as making any requests or automatic settlements, making it de facto forced.

What kind of bank data does the taxation office see? That's what you request to know.

The scale of access gained by the taxation office after the approval of the ZPP is unprecedented. It's not just an account balance. Fiscals gain insight into a wide scope of data that has so far been protected by bank secrecy. The list includes, among another things:

• Full transaction history: The authoritative will be able to see where, erstwhile and for what we spend money, and who we receive it from.
• Information on sources of influence: The strategy will automatically analyse regular deposits, trying to identify undisclosed sources of income.
• Data on borrowings and loans: Fiskus will know about our financial commitments, which can be utilized to measure our assets.
• Information on savings and investment products: The deposits, savings accounts or bank account-related investments will become an open book for the IRS.
• Data on standing orders and direct debits: This will let us to profile our regular expenses and lifestyles.

Consequences for the payer and possible scenarios for 2025

The provision of specified delicate data carries a serious risk. First of all, automation of controls. Algorithms will proceed to analyse our spending and compare it with officially declared income. Any anomaly, specified as buying costly equipment or receiving regular transfers from friends, may be the basis for starting a taxation check.

Second, it opens the way to more effective prosecution for insignificant offences, specified as non-payment of civilian law (PCC) taxation on a debt from the household or selling the item utilized online. The strategy itself will capture specified transactions and make a call for payment with interest. Although the aim is to seal the taxation system, it means the end of an era of any financial freedom and a sense of continuous surveillance. Consent in mCitizen thus becomes the digital key, which we ourselves let the controller into our home, and specifically – into our wallet.