Portugal Scams 2026: Three in Four Adults Hit, and the Phone Number Is Lying

Executive Summary: A Very Exposed Population

Portugal spent the last decade becoming one of Europe’s fastest-growing destinations for remote workers, retirees, and digital-nomad visa holders — and simultaneously digitising its public services faster than almost any comparable country. The Portal das Finanças, SNS 24, the Chave Móvel Digital: Portuguese life now runs through government logins.

Fraud followed both trends precisely.

A study of 1,360 adults in Portugal found that more than three quarters encountered a scam in the past year, with 9% suffering financial or data loss. That encounter rate is close to universal. The loss rate is lower than the alarm might suggest — Portuguese consumers are, on the whole, reasonably sceptical — but 9% of an adult population is several hundred thousand people, and the trend indicators for 2026 all point upward.

Tax Season Is Phishing Season

Portugal’s single most reliable fraud is the Autoridade Tributária impersonation, and it runs on a calendar.

Consumer organisation DECO PROteste and the Global Anti Scam Alliance have both flagged the pattern: at the start of the year, as filing season opens, fraudulent emails go out inviting taxpayers to click through to receive a tax refund. The messaging mimics Finanças branding, the link leads to a cloned Portal das Finanças login, and the harvest is NIF numbers, portal credentials, and — in the more aggressive variants — card details entered to “receive” the refund.

It is well-designed social engineering for three reasons. Refunds are genuinely issued, so the premise is plausible. The Portuguese tax authority genuinely does communicate electronically, so the channel is plausible. And a taxpayer who has just filed is expecting a message about their return.

The same template gets reused throughout the year with different senders: Segurança Social, CTT delivery notices demanding a small customs fee, EDP and other utilities, and toll-road operators. The customs-fee variant is particularly effective because the requested amount is trivially small — two or three euros — which lowers scrutiny while capturing a full set of card details.

Your Bank’s Number Is Not Your Bank

The most consequential Portuguese trend of 2026 is the industrialisation of caller ID spoofing.

Portugal’s national communications authority recorded 75 direct complaints about spoofed telephone calls in the first quarter of 2026 — an increase of 58 cases over the same period the previous year. In raw terms those are small numbers, because most people never file with the regulator; as a growth rate it is close to a fourfold increase in a single year.

What spoofing does is destroy the last verification heuristic most consumers have. When the number displayed on the screen is your bank’s published number, the police, or the tax authority, the standard advice to “check the caller” fails silently. The caller then runs the standard authorised-push-payment script: your account is compromised, we need to move your funds to a secure account, do not discuss this with branch staff because the investigation is confidential.

Because Portugal is on SEPA Instant, the transfer settles in seconds and cannot be recalled.

Romance Fraud, Rebuilt With AI

Ahead of Valentine’s Day 2026, Portugal’s National Cybersecurity Centre issued an explicit warning that organised fraud networks were laying traps for online daters that could siphon thousands of euros.

The formal numbers look small — the Portuguese Internet Safety Line recorded 49 romance-fraud cases in 2025 — and are universally understood to be a fraction of reality. Romance fraud has the lowest reporting rate of any consumer fraud category anywhere, because the loss is simultaneously financial and personal.

What changed in 2026 is the technology. Portuguese authorities specifically called out AI-generated fake video calls and chatbot-written love letters, which dismantle the two defences the public has been taught for a decade: ask for a video call and watch for bad language. A network can now sustain dozens of simultaneous, fluent, Portuguese-language relationships and pass a live video check.

Portugal’s demographics make this expensive. A large, comparatively wealthy population of foreign retirees and recent arrivals — often socially isolated, often navigating a new language and unfamiliar banking system — is exactly the target profile these networks optimise for.

The Expat Layer

Beyond romance fraud, Portugal’s foreign-resident population faces a distinct set of scams built around the friction of settling in.

Rental and property fraud is the most costly. Deposits demanded for apartments in Lisbon and Porto that the “landlord” doesn’t own, listings copied from legitimate agencies, and pressure to wire funds immediately because the market moves fast — which, unhelpfully, it genuinely does.

Bureaucratic facilitation scams offer to expedite NIF registration, residency appointments, golden visa or D7 applications, or SEF/AIMA slots for a fee, sometimes through convincing agency-branded websites. Some deliver nothing; others harvest the complete identity document set of a foreign national, which is worth far more than the fee.

Utility and installation scams target new arrivals who don’t yet know what a legitimate Portuguese utility interaction looks like — a doorstep visitor requiring immediate payment to “activate” a meter or connection.

Protecting Yourself

Never reach Finanças through a link. Type portaldasfinancas.gov.pt yourself or use the official app. The tax authority does not email you a link to claim a refund, and it does not ask for card details to pay one — refunds go to the IBAN already registered on your account.

Assume every incoming call’s number is fake. This is now the correct default in Portugal. If a caller claims to be your bank, the police, or Finanças, hang up, wait a moment for the line to clear, and call back on the number printed on your card or the institution’s published site. Legitimate callers never object.

No bank moves your money to a “secure account.” That account does not exist. Any instruction to transfer your own funds for safety is fraud, always, with no exception.

Treat requests to pay small “customs fees” on deliveries as phishing. CTT and courier fees are paid at delivery or through the carrier’s own verified app, not via an SMS link.

For online relationships: a video call no longer proves anything. The only reliable test is money. If someone you met online asks for funds, crypto, or help moving money — for a medical emergency, a customs hold, a business opportunity, a plane ticket — it is fraud regardless of what you have seen or heard. Talk to one real-world friend before sending anything.

Never pay a property deposit without physically viewing the property — yourself or through someone you know personally — and verify the landlord actually owns it via the Caderneta Predial. Keep payments traceable and never wire to a personal account abroad.

Use official channels for immigration and tax registration. A NIF or residency application does not require a private intermediary, and handing a full document set to an unverified “agency” is identity theft with extra steps.

Portugal built a genuinely excellent digital state, and its citizens and residents trust it — which is exactly the asset fraudsters are borrowing. Until caller ID and email sender identity can be trusted again, the only durable rule in Portugal is the oldest one: you contact them, never the other way round.