Fake Tax Office Scams in Portugal
Fraudsters impersonate the Autoridade Tributária e Aduaneira (AT) to steal Portal das Finanças credentials or extort EUR from Portuguese residents.
Part of: Fake Tax Office Scams
Last reviewed: 1 June 2026
AT (Autoridade Tributária e Aduaneira) impersonation is a recurring phishing threat in Portugal. Scammers send SMS or emails claiming IRS refunds or tax debts, directing victims to fake Portal das Finanças lookalike sites that harvest NIF (tax identification) credentials and banking details.
Portugal's Portal das Finanças is central to tax filing, invoicing, and property transactions. Compromising its credentials allows attackers to access tax returns, submit fraudulent invoices, or change bank accounts linked to tax refunds. CNCS (Centro Nacional de Cibersegurança) has issued multiple warnings.
How this scam works on Portugal
A phishing SMS claims an IRS refund of EUR 200–700 is pending and provides a link to a convincing portal das finanças lookalike. The site requests NIF and Portal das Finanças password, then captures them for later use.
Phone variants feature callers claiming to be AT inspectors with a specific EUR liability, threatening immediate bank-account freeze unless payment is made via Multibanco ATM reference code to a 'special AT payment account'.
Email variants attach fake assessment PDFs with AT letterheads and ask recipients to update their IBAN via a linked 'secure AT portal' — changing where future refunds are directed.
Common red flags
- SMS about a tax refund with a link — AT communicates via the official Portal das Finanças, not SMS links
- Caller threatens immediate bank-account freeze unless EUR is paid by phone
- Website URL is not exactly portaldasfinancas.gov.pt
- Request to provide NIF credentials or IBAN to a caller or unsolicited link
- Email from a non-at.gov.pt domain about a tax assessment
- Multibanco payment reference that you cannot find in your official AT account
How to protect yourself
- Access tax services only at portaldasfinancas.gov.pt typed directly
- Verify any refund or debt by logging into your official AT account
- Hang up and call AT at 217 206 707 to verify any caller's claim
- Never provide your NIF password or IBAN to a caller or via a link in a message
- Report suspicious messages to CNCS at cncs.gov.pt
- Enable email-alert notifications in your Portal das Finanças account settings
How to report it
- Report to CNCS at cncs.gov.pt/reportar
- File a complaint with Polícia Judiciária at policiajudiciaria.pt
- Contact AT directly at 217 206 707 so they can issue public warnings
Frequently asked questions
I clicked a link and entered my NIF and password on a fake AT page — what now?
Change your Portal das Finanças password immediately from a trusted device and monitor your account for unauthorised activity, such as changed banking details. Report the incident to CNCS and consider contacting AT directly to flag the compromise.
How do I verify whether I actually owe money to the AT?
Log into portaldasfinancas.gov.pt by typing the address directly and check your account status there, rather than trusting any figure quoted in an email or phone call. You can also call AT's official number to confirm.
Why do scammers target the tax-return season in Portugal specifically?
Many residents are genuinely expecting refund notifications during this period, making them more likely to respond quickly to a message about a refund without pausing to verify its authenticity.
Will the AT ever ask me to pay a tax debt using a Multibanco reference provided by a caller?
No. Legitimate AT payment references are generated exclusively within your Portal das Finanças account. Any Multibanco reference provided by a caller is fraudulent.