Fake Tax Office Scams in Portugal
Fraudsters impersonate the Autoridade Tributária e Aduaneira (AT) to steal Portal das Finanças credentials or extort EUR from Portuguese residents.
Part of: Fake Tax Office Scams
Last reviewed: 1 June 2026
AT (Autoridade Tributária e Aduaneira) impersonation is a recurring phishing threat in Portugal. Scammers send SMS or emails claiming IRS refunds or tax debts, directing victims to fake Portal das Finanças lookalike sites that harvest NIF (tax identification) credentials and banking details.
Portugal's Portal das Finanças is central to tax filing, invoicing, and property transactions. Compromising its credentials allows attackers to access tax returns, submit fraudulent invoices, or change bank accounts linked to tax refunds. CNCS (Centro Nacional de Cibersegurança) has issued multiple warnings.
How this scam works on Portugal
A phishing SMS claims an IRS refund of EUR 200–700 is pending and provides a link to a convincing portal das finanças lookalike. The site requests NIF and Portal das Finanças password, then captures them for later use.
Phone variants feature callers claiming to be AT inspectors with a specific EUR liability, threatening immediate bank-account freeze unless payment is made via Multibanco ATM reference code to a 'special AT payment account'.
Email variants attach fake assessment PDFs with AT letterheads and ask recipients to update their IBAN via a linked 'secure AT portal' — changing where future refunds are directed.
Common red flags
- SMS about a tax refund with a link — AT communicates via the official Portal das Finanças, not SMS links
- Caller threatens immediate bank-account freeze unless EUR is paid by phone
- Website URL is not exactly portaldasfinancas.gov.pt
- Request to provide NIF credentials or IBAN to a caller or unsolicited link
- Email from a non-at.gov.pt domain about a tax assessment
- Multibanco payment reference that you cannot find in your official AT account
How to protect yourself
- Access tax services only at portaldasfinancas.gov.pt typed directly
- Verify any refund or debt by logging into your official AT account
- Hang up and call AT at 217 206 707 to verify any caller's claim
- Never provide your NIF password or IBAN to a caller or via a link in a message
- Report suspicious messages to CNCS at cncs.gov.pt
- Enable email-alert notifications in your Portal das Finanças account settings
How to report it
- Report to CNCS at cncs.gov.pt/reportar
- File a complaint with Polícia Judiciária at policiajudiciaria.pt
- Contact AT directly at 217 206 707 so they can issue public warnings
Frequently asked questions
Will the AT ever ask me to pay a tax debt using a Multibanco reference provided by a caller?
No. Legitimate AT payment references are generated exclusively within your Portal das Finanças account. Any Multibanco reference provided by a caller is fraudulent.