That New Bank Card in Your Letterbox Could Be a Fake, the Bank of Portugal Warns, and a Real One Never Needs Urgent Activation

A new bank card arriving in the post is normally routine. The Bank of Portugal warned on Thursday that it may now be the start of a fraud: criminals are posting fake cards, with a letter that urges the recipient to activate them at once, in order to get into victims' bank accounts.

The letters can look convincing. "Criminals may have obtained some of your details beforehand, for example your name, address and the bank you are a customer of, which allows them to personalise the communication they send by post," the central bank said. It asks people to be careful even when "the card appears to be legitimate and issued by your bank", and to judge the letter by what it asks them to do.

The warning signs

The clearest signal is pressure. "Always be suspicious if you are asked to act immediately, for example with a threat to block your account," the Bank of Portugal said.

A genuine replacement never needs to be rushed. Cards are valid until the last day indicated on the card itself, and banks send the new one in the weeks before the old one expires, so there is time to activate it calmly. The fake letters include phone numbers, links or QR codes for "activation". These can lead to copies of a bank's website that look like the real thing, where the criminals collect personal and security details and can then move money out of the account.

Only three ways to activate a card

According to the central bank, a card can be activated in only three ways:

• at a cash machine (Multibanco ATM);
• on your bank's own website;
• in your bank's own app.

Do not use any contact, link or QR code given in the letter, either to activate the card or to check whether the letter is genuine. If in doubt, contact your bank through the channels you already know, such as its app, the website address you normally type in, or your branch.

Why it matters for newcomers

The scam plays on the fact that most people do not remember when their card expires and cannot easily tell a real bank letter from a fake one. Newer residents, who may still be learning how Portuguese banks communicate and may be reading letters in a second language, are an obvious target. A letter in Portuguese that mentions account blocking and asks for urgent action is exactly the pattern the Bank of Portugal describes.

If you have already scanned a code, called a number or typed details into a page reached from such a letter, contact your bank straight away so it can block the card and check for unusual movements. Fraud can also be reported to the police.

The warning follows a run of frauds and alerts in recent weeks. In September the securities market regulator, the CMVM, warned that investment scammers now use AI-generated video, and impostors using a real government email domain obtained customer files from Revolut. The common thread is the same: a message that looks official and demands quick action. A real bank can wait while you check.