Tax Scam Alert: Fake Emails and SMS Messages Target Portuguese Taxpayers During IRS Season

Portugal's Tax and Customs Authority (AT) has issued an urgent warning about fraudulent email and SMS campaigns targeting taxpayers during the current IRS filing period. The scams impersonate official tax communications, demanding payments for fictitious "regularisation" requirements or offering fake refunds designed to harvest bank details. With the e-Fatura deduction review period running until March 31 and IRS filing opening on April 1, the timing is calculated to catch taxpayers at their most vulnerable.

How the Scams Work

The AT has identified multiple phishing campaigns currently in circulation. Fraudulent emails arrive with official-sounding subject lines such as "Document for regularisation 3 IRS 2024" or "Pending Conclusion 3 Provisional Income Tax Deductions." The senders use names designed to appear legitimate, including "Financas Deducao" and "Deductions," but the actual email addresses clearly reveal their fraudulent origin, using domains like "resolucaocidadaosempapel.blog" and "rumolivre.blog."

Some emails attempt to convince recipients to click links that lead to malicious websites. Others direct targets to provide bank details to receive an alleged "tax refund" that is supposedly pending payment. In both cases, the goal is either to install malware or steal financial information.

SMS Phishing Campaign

A parallel campaign uses text messages sent under the spoofed sender name "AT.GOV.PT" to add false credibility. The messages typically contain threatening language such as "Seizure process initiated. Last day for payment. Avoid additional costs" followed by a malicious link.

The use of SMS is particularly effective because many Portuguese taxpayers are accustomed to receiving legitimate notifications from government agencies by text. The urgent, threatening tone is designed to provoke an immediate, unthinking response.

How to Protect Yourself

The Tax Authority has published clear guidance on its Finance Portal. Key recommendations include:

• Never click links in emails or SMS messages claiming to be from the tax authority
• Never download files or attachments from unverified messages
• Never provide your Finance Portal login credentials in response to an email or text
• Never share bank details through links sent via email or SMS
• Delete messages of unknown origin or with dubious content immediately

Legitimate communications from the AT direct taxpayers to access the Finance Portal directly by typing the URL into their browser, not through embedded links. Any genuine tax obligations, refunds, or regularisation requirements will be visible within your authenticated Portal das Financas account.

Why Expats Are Especially Vulnerable

Foreign residents and expats face heightened risk from these scams for several reasons. Many are unfamiliar with how the Portuguese tax system communicates and may not immediately recognise a fraudulent message. Those who are new to the IRS filing process may feel anxious about compliance, making threatening messages about "seizure processes" or "regularisation requirements" more convincing.

Language barriers add another layer of vulnerability. Scam messages may arrive in Portuguese, and a non-native speaker might click a link rather than carefully parsing the sender address or message content.

If you have any doubt about a communication claiming to be from the tax authority, access the Finance Portal directly at portaldasfinancas.gov.pt and check your account for any genuine notifications. You can also contact the AT directly through the official channels listed on their website.

The Broader Context

Tax-related phishing intensifies every year during filing season, and 2026 is no exception. The current e-Fatura review period, running from March 16 to 31, and the imminent opening of IRS filing on April 1 create a concentrated window when taxpayers are actively engaging with the system, making them prime targets.

The AT's warning follows a pattern of increasingly sophisticated scam operations targeting Portuguese taxpayers. Staying vigilant, verifying all communications through official channels, and never acting on unsolicited messages remain the best defences.