Banco de Portugal warns of fake Multibanco cards sent by post in new fraud scheme
Portugal's central bank issued a fresh alert on 1 October 2026 about a sophisticated fraud involving counterfeit Multibanco cards sent through the mail. Criminals are obtaining personal data in advance to make their communications appear legitimate, then directing recipients to fraudulent websites to 'activate' cards that do not exist.
How the scam works
The scheme begins when a resident receives an unsolicited letter containing what appears to be a bank card. The accompanying correspondence often includes links, QR codes or contact numbers that lead to fake banking pages designed to harvest credentials and personal information.
According to the Banco de Portugal, criminals have been acquiring victim data — including names, addresses and bank names — beforehand. This allows them to personalize letters with accurate details, making the fraud more convincing than typical mass-market phishing attempts.
The false communications typically demand immediate action, sometimes threatening to block accounts if the recipient fails to respond quickly. The bank advises treating any such ultimatum with suspicion.
What residents should check
A legitimate card remains valid until the final day printed on its face. Banks send replacement cards several weeks before expiry, through a measured process that does not require urgent activation.
If the current card remains valid and no renewal was expected, the Banco de Portugal says a recipient should be especially wary. The institution also notes that legitimate cards can only be activated through three channels: at an ATM (caixa automático), through the bank's official website, or via the bank's own mobile application.
Residents should not use any contact details, hyperlinks or QR codes printed in a suspicious letter to verify its authenticity. Such links may direct to pages that closely resemble legitimate bank sites.
Why this matters now
Fraud involving payment cards and bank transfers caused losses approaching €9 million in the first half of 2025, according to figures released in September 2026 in the bank's payments systems report. The same data show the average loss per fraudulent transaction reached €58, an increase of €11 over the previous year.
Phishing — where criminals pose as legitimate institutions to extract sensitive information — remains the dominant form of fraud. This new postal scheme is a variation on that method, using physical mail rather than email or text messages.
Steps to take
If a letter arrives unexpectedly with a card and the resident did not request one, the Banco de Portugal recommends:
• Contacting the bank directly using known numbers from official sources, not details from the letter itself
• Checking whether the bank sent any notification via its app or other channels about an incoming card
• Remembering that banks do not send unsolicited cards except to replace ones already in use and approaching expiry
Anyone who suspects they have received a fraudulent card should notify their bank immediately. The Banco de Portugal has also reminded residents to protect PIN numbers by covering keypads at ATMs and payment terminals, and to remain vigilant about devices that appear altered or damaged.
