Spoofed Calls Targeting Portugal: PSP's Guide to Protecting Your Bank Account and Identity

The Portugal National Communications Authority has recorded 75 direct complaints about spoofed telephone calls in the first quarter of 2026—an increase of 58 cases compared to the same period last year. For residents and expats navigating life in Portugal, this surge in fraudulent calls means your bank, tax authority, or even the police number flashing on your screen could be a sophisticated scam designed to drain your account or steal your identity.

Why This Matters

• Fraud is accelerating: Q1 2026 saw 75 spoofing complaints, representing a 58-case increase from Q1 2025.

• Your caller ID lies: Scammers use technology to display legitimate numbers—including official government agencies and financial institutions.

• Legal reform is pending: ANACOM has proposed changes to Portugal's Electronic Communications Law to enable operators to filter fraudulent calls at the network level, but the legislative process remains slow while criminals adapt faster.

• Blocking is your first defense: The Portugal Public Security Police (PSP) and telecom regulators now recommend specific actions—not just ignoring calls.

The Anatomy of a Spoofing Attack

Spoofing is the digital equivalent of a forged passport. Criminals use Voice over IP (VoIP) platforms to mask their real location—often overseas—and program the caller ID to display a trusted Portuguese number. The goal is simple: manipulate you into handing over passwords, tax ID numbers, or bank credentials before you realize the deception.

In early 2026, ANACOM itself became a target. Fraudsters impersonated ANACOM staff, calling victims from the regulator's own helpline number and claiming their phones had been used for illegal SMS campaigns or theft. The fake agents threatened service suspensions and demanded personal data to "resolve" the fabricated crisis. ANACOM was forced to issue a public alert: it never initiates contact to request personal information by phone.

Similar schemes have targeted the Autoridade Tributária e Aduaneira (Portugal's Tax Authority). Fake emails and SMS messages—complete with official logos—directed recipients to cloned versions of the Portal das Finanças. Once users entered login credentials, the data was harvested in real time.

What the PSP and ANACOM Want You to Do

The official guidance from Portuguese authorities is clear and action-oriented:

Do not answer or return calls from numbers you don't recognize, even if they appear legitimate. If the caller claims to represent your bank, the tax office, or a telecom provider, hang up immediately and dial the institution's official number from their website or your account statement—never use contact details provided by the caller.

Never confirm or provide personal, fiscal, or banking data over the phone. No legitimate entity in Portugal will ask for your NIF (Número de Identificação Fiscal), passwords, or credit card PINs via unsolicited calls.

Block the number after a suspicious call. On Android, open your call history, tap the number, and select "Block" or "Report spam." On iOS, enable "Silence Unknown Callers" in Settings > Phone to automatically send unrecognized numbers to voicemail.

Report every attempt, even if you weren't defrauded. File complaints with your mobile operator or the PSP. Each report helps authorities map fraud networks and protect others.

Impact on Residents and the Business Community

For Portugal-based companies, spoofing poses a compliance and reputational risk. Businesses in banking, telecoms, and utilities face customer distrust when fraudsters hijack their numbers. For individual residents, the financial exposure is immediate. Victims who share authentication codes or banking passwords can lose savings in minutes. The psychological toll is equally real: many report anxiety about answering any unknown call, disrupting legitimate business and personal communication.

Technology and Legislative Countermeasures

ANACOM has proposed amending the Lei das Comunicações Eletrónicas to authorize operators to filter spam and fraudulent calls at the network level. The Socialist Party has pressed the government for action, but no bill has reached parliament as of late April 2026.

Some operators have implemented opt-in call-screening services. Consumer-grade apps like Truecaller and Hiya provide crowdsourced spam databases, though privacy advocates caution about sharing contact lists with third-party platforms.

The Lista de Oposição ao Marketing (LOPM), Portugal's do-not-call registry, remains effective against legitimate telemarketers but has limited impact on criminal spoofing, which operates outside regulatory frameworks.

Practical Steps Beyond Blocking

Install a call-screening app. Truecaller maintains an updated database of reported scam numbers. Alternatives include Sync.ME and CallApp. Enable auto-block for high-risk calls and review flagged numbers regularly.

Use two-factor authentication everywhere. Even if a fraudster obtains your password, 2FA via an authenticator app (not SMS, which can be intercepted) creates a second barrier.

Search suspicious numbers online. Portuguese forums like "Ligaram-me" and "Tellows Portugal" let users report and check numbers. A quick search can reveal if others have flagged the caller.

Request operator-level blocking for anonymous calls. Be aware this will block all unidentified callers, including some legitimate sources like hospitals. For persistent harassment, contact your operator about available protections.

The Social Engineering Factor

What makes spoofing so effective in Portugal is the exploitation of cultural trust in institutions. Portuguese society maintains relatively high confidence in public agencies, banks, and state-owned enterprises. Fraudsters weaponize this trust, knowing that a call appearing to come from the Finanças or PSP triggers compliance rather than skepticism.

The scams also leverage partial data accuracy. Criminals often possess fragments of real information—your name, partial NIF, or recent transaction history—acquired through data breaches or social media scraping. This creates a false sense of legitimacy that even cautious individuals find hard to dismiss.

What's Next

Until Portugal's legislature closes the regulatory gap, residents should assume caller ID is unreliable. The burden of verification falls on you: treat every unsolicited call as potentially fraudulent until you independently confirm the source.

In the meantime, the spoofing epidemic is a daily reminder that in 2026, your phone is both a lifeline and a liability. The simplest defense remains the most effective: when in doubt, hang up.