Portugal Scams: Online, Tourist & Investment Fraud Guide
Common scams in Portugal and how to report via the Cybercrime Office, PSP, and your bank.
Emergency number: 112 — verify on official sources.
Last reviewed: 1 August 2026
Portugal sees online fraud including phishing and smishing impersonating banks, CTT (postal service), or the tax authority (AT), as well as tourist-area street scams and investment fraud. The Cybercrime Office of the Public Prosecution Service (Gabinete de Cibercrime) is the official channel for reporting cybercrime, the PSP handles general police complaints, and the National Cybersecurity Centre (CNCS) provides public guidance on threats.
Portugal's signature fraud is the MB Way scam. MB Way, the ubiquitous mobile payment app tied to Multibanco, lets a fraudster who obtains your phone number and a confirmation code register your card on their own device. The classic play targets OLX sellers: a 'buyer' insists on paying via MB Way and talks the seller through operations at an ATM or in the app that actually authorise payments out or associate the seller's card with the fraudster's phone. If anyone directs your fingers through MB Way or Multibanco menus, stop — receiving money never requires entering codes someone dictates. The 'Olá pai / Olá mãe' WhatsApp scam is the other national staple: a message from a 'child with a broken phone' on a new number asks for urgent transfers, and it has extracted large sums from Portuguese parents.
Beyond these, smishing waves impersonate CTT with customs-fee links, banks with 'blocked account' alerts, and the AT with fake debt notices around tax deadlines. Rental fraud is intense in Lisbon and Porto's tight housing markets — deposits taken for apartments that are already let or never existed — and tourist zones see the standard European repertoire of distraction pickpocketing, inflated menus, and 'friendship bracelet' hustles. Investment scams push crypto platforms through social ads and cold calls; the CMVM's warnings are worth checking first. When money moves, call your bank immediately, then report to the Gabinete de Cibercrime or PSP.
Common scams
- Phishing and smishing impersonating Portuguese banks or CTT
- AT (tax authority) impersonation
- Investment and crypto fraud
- Online marketplace non-delivery
Tourist-specific scams
- Overcharging restaurants and unlicensed taxis
- Distraction pickpocketing in Lisbon and Porto tourist areas
- Fake tour operators and street sellers
Online shopping scams
- Parcel-fee smishing impersonating CTT
- Fake online shops
- Account takeover phishing targeting banking credentials
Job scams
- Task scams via messaging apps
- Fake job offers requiring upfront fees or documentation payments
- Seasonal tourism and agriculture job offers charging 'placement' fees
Romance scams
- Dating-app romance and cryptocurrency investment grooming
- 'Olá pai / Olá mãe' WhatsApp messages impersonating children
- Long-distance partners with escalating emergencies
Investment scams
- Fake trading platforms and clone broker firms
- Crypto and 'AI bot' investment schemes
- Social media crypto ads with fabricated celebrity endorsements
How to report a scam here
- Contact your bank immediately if money was transferred
- Report cybercrime to the Gabinete de Cibercrime at cibercrime.ministeriopublico.pt or by email at [email protected]
- File a police complaint with the PSP at a local station or via psp.pt
Local reporting & protection links
Always verify reporting routes and emergency contacts on the official government or agency website for your country.
Bank & payment guidance
Contact your bank at once through its official app or the number printed on your card, never through a link or phone number supplied by whoever contacted you. Portuguese banks can attempt to recall a fraudulent transfer most effectively within the first few hours, and money often moves on quickly. State that you were deceived into authorising the payment, ask for the receiving account to be reported, and keep the reference number. If the scam involved MB Way, tell the bank to check whether your card has been associated with an unknown device and to remove it — that association is how fraudsters keep spending after the first hit — and have the card blocked and reissued. If credentials were entered on a site reached from a message, ask for them to be reset from a clean device. File a complaint with the Gabinete de Cibercrime or PSP so the bank's fraud case has an official reference, and keep the SMS or WhatsApp thread intact as evidence.
Evidence to preserve
- Screenshot all messages, profiles, websites and payment pages
- Save transaction references, account numbers and crypto wallet addresses
- Keep emails with full headers where possible
- Note dates, times, names and phone numbers used
Frequently asked questions
What is the Gabinete de Cibercrime?
It is the Cybercrime Office of the Portuguese Public Prosecution Service (Ministério Público), which receives and processes cybercrime complaints. You can report online at cibercrime.ministeriopublico.pt or by email at [email protected].
Does the AT (Autoridade Tributária) contact taxpayers by SMS?
The Portuguese tax authority may use SMS for some notifications, but it will never send a link asking for banking credentials or urgent payments. Treat any such message as a phishing attempt.
What is the MB Way scam?
A fraudster — typically posing as a buyer on OLX — talks the victim through MB Way or Multibanco operations that secretly register the victim's card on the fraudster's phone or authorise outgoing payments. Receiving money never requires entering codes someone dictates to you. If it happened, have your bank remove unknown device associations and block the card immediately.
Sources
- National police and cybercrime portals (verify on official sites)
- FTC / Action Fraud / Scamwatch consumer guidance