Latest news and stories about phishing in legal in Portugal for expats and residents.
Banks in Portugal must now immediately reimburse customers who fall victim to phishing and unauthorized payment transactions. Financial institutions cannot withhold stolen funds by alleging gross customer negligence, and must return the money before seeking any restitution. Lenders may only recover reimbursed amounts later if they formally prove the client acted with severe negligence.
The Attorney General's Office (PGR) has warned of a phishing e-mail that claims recipients must pay an alleged parking fine. The message includes a 'Pay online' button that leads to a fraudulent webpage designed to mimic the state's Autenticação.Gov authentication platform; criminals use the fake page to harvest third-party bank account details. The PGR's Cybercrime Office highlights this tactic as part of a wider e-mail scam campaign. Recipients are advised not to follow links in unexpected messages, to verify official sites through known channels, and to report suspicious e-mails to the relevant authorities.
If you have received a message asking for help for 'a friend's daughter', you may be a victim of phishing. Scam attempts are becoming increasingly difficult to identify.
Phishing attacks accounted for 23% of intrusions observed in 2026.
A new ESET report reveals that cyberattacks on macOS systems in Portugal rose by 65% in the first half of 2026, significantly outpacing the global growth rate. The surge is driven by credential-stealing trojans and potentially unwanted software. The report also highlights the emergence of 'PromptSpy', the first Android malware to integrate real-time generative AI, and warns of rising threats like 'quishing' (QR code phishing) and risks associated with autonomous AI agents in corporate environments.
A report highlights that scams involving QR codes are increasingly common in email phishing campaigns targeting Portuguese users, providing advice on how to stay safe.
The tax authority emphasises that it only sends emails from addresses ending in @at.gov.pt and that it never includes links in those messages.
The booking platform confirmed unauthorized access that exposed travel details and contact information for several customers, paving the way for personalized fraud schemes and phishing messages.
The Tax and Customs Authority (AT) has issued a warning about fraudulent emails and text messages circulating in its name, demanding tax regularisations or promising tax refunds. The AT advises taxpayers to ignore these messages, which contain malicious links designed to steal banking details or credentials, and recommends checking their official information security leaflet for guidance on how to handle such phishing attempts.
The Portuguese Security Intelligence Service (SIS) has issued a warning regarding an international cyber-espionage operation sponsored by a foreign state. The campaign targets government officials, diplomats, military personnel, and individuals with access to sensitive information. The attacks do not exploit vulnerabilities in WhatsApp or Signal themselves, but rather use social engineering, phishing, quishing, and AI-generated content to trick users into compromising their own accounts. The intelligence services have provided six security recommendations, including verifying new contacts through alternative channels and never sharing account verification codes.
This article reports that a Europol-led international law enforcement operation successfully disrupted Tycoon2FA, a major phishing-as-a-service platform responsible for tens of millions of phishing messages monthly. The operation involved seizing 330 domains linked to the platform's infrastructure, including control panels and phishing pages, and was supported by private partners like Microsoft, Cloudflare, Coinbase, and others. Tycoon2FA, active since at least August 2023, targeted organizations worldwide—including those in Portugal—by bypassing multi-factor authentication (MFA) to compromise nearly 100,000 accounts across sectors such as government, healthcare, and education. The platform used sophisticated techniques like reverse proxy servers to intercept login credentials and session cookies, enabling attackers to hijack sessions and evade MFA protections. The disruption aims to reduce the threat posed by this widespread phishing operation.
SPMS said two types of fake SMS messages are circulating, both requesting payment for emergency charges — one includes a bank reference and the other contains links to fraudulent websites.
Victims first receive a message about payment of a fine. A 'Pay online' button then directs them to a fraudulent webpage.
Victims receive an e-mail saying they must pay a parking fine and are directed to a web page. On the fraudulent site, criminals attempt to obtain bank account details.
The Office of the Attorney General (PGR) warned on Tuesday about the spread of an email scam aimed at obtaining third-party bank details via a fraudulent page resembling the Autenticação.Gov platform. In a statement, the PGR's Cybercrime Office explains that victims first receive a message about an alleged fine ...
'Phishing', a fraudulent technique that tricks users into visiting certain websites and disclosing their data, is already responsible for one in four attacks.
