Scammers Exploit Portugal's Continente Loyalty Card Through SMS Hoax

Anyone who has spent more than a few weeks in Portugal quickly learns that the country’s largest supermarket chain, Continente, all but expects shoppers to flash a red-and-white loyalty card at checkout. That familiar routine has now turned into an attractive lure for criminals running the latest wave of SMS fraud. Portuguese prosecutors say thousands of phones have already received messages claiming that points on the Cartão Continente will expire within hours unless the holder clicks a link to “renew” benefits—and clicks are exactly what the attackers need to drain credit cards.

A supermarket perk foreigners quickly adopt

For many newcomers, signing up for the Cartão Continente is one of the first bits of bureaucracy tackled after opening a local bank account. The card unlocks member-only discounts on everything from vinho verde to nappies, plus fuel savings at Galp petrol stations. Roughly 4.2 M people—nearly 40 % of Portugal’s population—swipe the card every month, according to owner Sonae MC. That enormous user base gives cyber-crooks the confidence that a blanket text blast, even in imperfect Portuguese, will find plenty of real cardholders.

How the latest smishing wave works

The Gabinete de Cibercrime within the Attorney General’s Office says the campaign begins with “masked” phone numbers borrowed from innocent owners. Recipients see a short text mentioning the approaching expiry of loyalty points and urging a quick visit to a site that always embeds the string "cartaocontinente" in the URL. The landing page is an uncanny clone of Continente’s genuine portal, complete with rotating banners and the familiar red palette. Victims are asked to type in their name, address, mobile number and, crucially, every field on their payment card—holder name, 16-digit number, expiry date and CVV. The data is then routed to servers outside Portugal and sold or used immediately for fraudulent purchases.

What the authorities and Continente are doing

Prosecutors published a formal alert on 11 September, stressing that “Continente never asks for card or bank details via SMS”. The chain itself has pushed in-app warnings, updated FAQ pages and placed discreet banners at store entrances. Portugal’s cyber-response centre CERT.PT confirms an overall 77 % rise in reported phishing and smishing attempts in 2024 compared with the previous year, a figure that prompted the Polícia Judiciária to assign extra analysts to loyalty-card scams. Continente’s parent Sonae MC says it is accelerating multi-factor sign-in on its shopping app and tightening the rules for generating promotional links.

Immediate steps if you receive the text

Cyber-investigators urge residents to delete the message, block the sender and avoid clicking—even out of curiosity. Anyone who already submitted card details should phone their bank’s 24-hour emergency line and request an instant cancellation. In Portugal this process can be handled in English with most major lenders. Victims should also file a complaint through the online portal of the Ministério Público; doing so helps law-enforcement trace the infrastructure behind the scam.

Portugal is not alone—loyalty fraud is booming across Europe

Similar cons hit Carrefour shoppers in France last year, and a U.K. study published in May revealed a 156 % jump in social-engineering fraud targeting loyalty schemes. Analysts blame the affordability of AI tools that generate convincing copy in multiple languages, letting criminals recycle the same template from Paris to Porto with minimal tweaking.

Looking ahead: tougher tech and tighter laws

Sonae MC says it is testing real-time anomaly detection that freezes points redemptions when geographic or spending patterns look odd. Meanwhile Brussels is finalising revisions to the Payment Services Directive, expected to impose stricter identity checks on any system that converts loyalty points into monetary value. For foreigners living in Portugal, the takeaway is straightforward: enjoy the discounts, but never trust an unsolicited link—because no supermarket, however friendly, will ask for your CVV over SMS.