Cabinet Hands ANACOM a Spoofing-Blocking Mandate and Pré-Pagos Identification Rule on Friday 29 May — Operators Must Filter Fraudulent SMS Hyperlinks and Wire Up Caller-Identity Checks Before the Assembleia Translation

The Friday 29 May Conselho de Ministros approved an autorização legislativa to rewrite the Lei das Comunicações Eletrónicas, loading three substantive obligations onto MEO, NOS, Vodafone and the smaller MVNO and reseller layer of the Portuguese telecoms market: operator-level blocking or anonymisation of fraudulent SMS messages and deceptive hyperlinks; mandatory identification of pré-pagos SIM users; and authority to install mobile-signal inhibitors inside prison facilities. The proposal heads to the Assembleia da República for ratification before the substantive Lei das Comunicações Eletrónicas amendments can be issued by decree-law and pushed through ANACOM’s regulatory pipeline.

The Spoofing Gap That Drove the Decision

Banco de Portugal Governor Mário Centeno told the Comissão de Orçamento e Finanças in late 2025 that Portugal was the only European country without a spoofing-specific legal framework — a gap that has let callers and SMS senders falsify numbers to impersonate banks, the AT, AIMA, Segurança Social and the SNS appointment-confirmation flow. ANACOM president Sandra Maximiano has stated repeatedly that operator-side technical solutions exist but were blocked by the absence of an authorising legal base. The BdP’s own fraud-prevention tools have intercepted €6.5 million in fraudulent transfers since May 2024 — what the supervisory rails caught, not the consumer-direct total.

Pré-Pagos Identification and Prison Jammers

The second leg ends the long-standing Portuguese exception of anonymous pré-pagos SIM purchases. New cards will require ID at the point of sale; the existing pré-pagos base will face a re-identification window the Assembleia is expected to set in the law-translation phase. The third leg authorises the Direcção-Geral de Reinserção e Serviços Prisionais to install mobile-signal jammers inside prisons, operating under an ANACOM-coordinated controlled-frequency framework to avoid bleed into adjacent civilian cells.

The Parliamentary and Regulatory Path

The autorização legislativa cannot by itself bind operators. The Assembleia must vote it through, the Government then issues the substantive decree-law (timing, sanctions, ANACOM rule-making powers), and ANACOM publishes the technical regulamento that fixes the spoofing-detection thresholds. The PS questioned the Government on consumer protection against spoofing on 5 May, and Bloco de Esquerda and Livre have signalled support for a stronger consumer-protection layer in the Assembleia translation.

What to Watch Next

• Sanctions design: the spoofing-blocking obligation needs an enforcement architecture — whether ANACOM gets administrative-fine powers in line with the LSCC regime or a lighter coordination role will determine real-world compliance pressure on operators.
• Pré-pagos timeline: the re-identification window is the operational pressure point; sector estimates run from 12 to 24 months to clear the back-book.
• Bank API integration: the BdP has been pushing for a shared fraud-signature framework that operators can query in real time; the decree-law will need to either name that framework or leave it for a downstream protocol.
• EU alignment: Portugal’s decision aligns the country with the Council of the EU’s ongoing work on a Pan-EU Anti-Spoofing Directive, expected in the next Commission cycle.

The Friday decision will not stop a single fraudulent SMS this weekend — the substantive rules still need to be written and notified to Brussels — but it is the procedural turning point that finally puts Portugal on the path the BdP, ANACOM, the banking sector and consumer-protection groups have been asking for since the spoofing wave broke during the 2024 cost-of-living crisis.