The Tax Office Adds Phone Calls to Its Fraud Warning, as the Bank of Portugal Names Two Unlicensed Operators

Portugal's tax authority has widened its fraud warning to cover something it had not flagged before: the telephone. The Autoridade Tributária e Aduaneira (Tax and Customs Authority) told taxpayers on Friday that alongside the familiar fake emails and text messages, criminals are now placing calls asking people to press a key to "correct a discrepancy" in their IRS return.

The AT set out three vectors it is currently seeing:

• Email: messages asking you to click a link.
• SMS: messages asking you to validate your data.
• Telephone calls: calls asking you to press a key to resolve a divergence in your income tax declaration.

Its instruction was blunt: "Under no circumstances should you carry out those operations. Wherever possible, confirm the origin of these messages."

The test that actually works

The AT's own rules give taxpayers a way to settle any doubt without engaging with the message at all. Communications sent centrally by the tax authority are deposited in the Portal das Finanças. To read them, log in, authenticate, and select "Comunicações" from the side menu. If a supposed notification does not appear there, it did not come from the AT.

Two further checks come from the authority's standing security alert, republished on 3 August:

• The AT only sends emails from addresses ending in @at.gov.pt.
• It never sends emails or SMS containing links to enter, change or confirm personal or tax data, and never requests payment through a link sent by email or SMS.

There is one more filter worth knowing, and it is the one most people miss. The AT says it only sends informational communications to taxpayers who have actively switched on email and SMS notifications and whose contact details are confirmed on file. If you never enabled those alerts, any message claiming to be from Finanças is fraudulent by definition.

The central bank is naming names too

The same week brought two notices from the Banco de Portugal (Bank of Portugal) about entities operating without a licence. On Friday it warned that Fafetine Armando Moiane (NIF 308122232), acting in his own name or on behalf of third parties, is not authorised to provide payment services, including the sending of funds. The warning cites Article 11(1) of Decreto-Lei 91/2018 of 12 November, which reserves the provision of payment services in Portugal to supervised institutions.

On 19 August the supervisor issued a parallel notice on Fiável Crédito Portugal Lda, which it says is authorised neither to grant credit nor to carry on intermediation and advisory activities.

Unlicensed money-remittance and lending operations tend to find the same customers: people sending money home, and people whom mainstream banks have already turned down. Neither group has recourse to the deposit guarantee or the supervisory complaints machinery if the operator disappears.

What this means for you

• The phone call is the new one: a recorded or live call about an IRS "divergência" asking you to press a key is not the AT. Hang up and check "Comunicações" on the Portal das Finanças.
• Language is being used against you: foreign residents who read Portuguese haltingly are exactly the target for an official-sounding message about a tax problem. Slow down rather than acting quickly.
• Never pay through a link: real tax payments use a reference number generated inside the Portal das Finanças, which you then pay through Multibanco or your own bank. There is no legitimate email that takes you straight to a payment page.
• Verify a lender before you borrow: the Bank of Portugal publishes both its register of authorised institutions and its list of warnings. An entity absent from the first and present on the second is not one to send money to.
• This is a pattern, not an incident: in July the AT warned of fake emails telling freelancers to issue "missing" green receipts, and in May AIMA flagged appointment fraud aimed at foreign residents. The impersonated institution changes; the mechanics do not.

The Bank of Portugal has already floated a national blacklist of bank accounts used in payment fraud as part of its 2030 retail-payments strategy. Until something like that exists, the defence is procedural rather than technical: treat every unsolicited contact about your tax affairs as unverified, and go to the portal yourself.