How to spot fraud in Portugal and try to get your money back
We go through eight common schemes: from fake rentals and employers to calls from the ‘bank’, a swapped IBAN, problem cars, crypto investments, a fake bank card by post and a staged accident in a car park. For each one — a specific sign to check and what to do if you have already sent the money.
Check a rental listing before paying anything up front
How the scheme works: photos and the description are copied from a genuine listing, and the ‘owner’ asks you to transfer a reserva or caução — a booking fee or deposit — urgently. They may be abroad, refuse a viewing, send someone else's documents or promise to hand over the keys after full payment. Paying up front does not in itself prove fraud: in Portugal people really do book homes remotely, but only after checking the owner or the agency.
The main sign is that the person receiving the money is not the owner, the agent or a party to the contract and cannot explain this with documents. Ask for a Certidão Permanente Predial (permanent extract from the property register) and check the owner and the address. For an agent, look up the AMI number in the IMPIC register (Institute of Real Estate and Construction Markets). Check the identity document, the contract, the IBAN and the representative's authority; a video viewing alone is not enough.
If the money has gone, ask your bank straight away to recall the transfer, and the payment platform to freeze the payout. Keep the listing, the contract, the messages, the IBAN, the recipient's name and the proof of payment. Report it to the PJ — Polícia Judiciária (Criminal Investigation Police), the PSP — Polícia de Segurança Pública (Public Security Police) or the GNR — Guarda Nacional Republicana (National Republican Guard), and also report the listing to the website. A transfer cannot always be recalled, and it usually depends on whether the money is still in the recipient's account.
“To be fair, in Portugal they often ask for money up front. Last time we rented completely remotely and transferred the whole amount before we even had the keys, having only checked that the agency really exists and the details in the contract 🌚 But of course there are plenty of scammers too, you have to look at the case as a whole.”
Translated from Russian; the original is at the linkchatlisboa24.08.2026
“My wife and I need to show accommodation for 4 months for the Portuguese visa. At first we wanted to rent an airbnb for a week and calmly find a permanent flat once we were there, but the consulate doesn't accept that. Airbnb and Housing anywhere for 4 months cost an insane amount of money, and on Flatio half the listings I wrote to turned out to be scams.”
Translated from Russian; the original is at the linkleft4portugal31.07.2026
Tell a real employer from a fake vacancy
How the scheme works: they promise a quick start and steady pay, but ask you to pay for paperwork, training, a uniform, accommodation or ‘activating your salary account’. Another version: the company exists and even signs a contract, but keeps hiring new migrants without paying them what they have earned. A contract and insurance do not in themselves guarantee you will be paid.
Check the NIPC — Número de Identificação de Pessoa Coletiva (the organisation's tax number), the company's name and address. Ask for the code of the Certidão Permanente Comercial (permanent commercial register extract) and make sure the contract is signed by an authorised person. Once you start work, check in Segurança Social Direta (your social security online account) whether the employer has declared the employment and your pay. Being asked to take customers' money into your personal account, buy cryptocurrency or send funds on is a sign of a money mule scheme.
If you have not been paid, send the employer a written demand listing the shifts, hours and amount, then go to the ACT — Autoridade para as Condições do Trabalho (labour inspectorate). A money claim may require going to the Tribunal do Trabalho (labour court) or to the Ministério Público (public prosecutor's office) attached to it. If you paid for a vacancy, ask for the transfer to be recalled and report the fraud at the same time. Keep timesheets, geolocation, messages, the contract, payslips and your colleagues' contacts.
“#porto Contractor: [username] - Atlantic DM - a company of scammers, the boss is Denis Galanov. Hires immigrants from different countries, doesn't mind signing contracts and arranging insurance, but they still won't pay you for the work. Right in front of me they cheated 5 people (6 including me): two from Ukraine, one from Brazil and two from Morocco. They post lots of ads from different numbers.”
Translated from Russian; the original is at the linkproflistpt03.08.2026
Double-check a call from the ‘bank’ or the ‘police’
How the scheme works: first an SMS arrives about a blocked account, a debt or a suspicious transaction, then the ‘security department’ calls. The caller asks for your login details and one-time codes, to install a remote access program or to transfer money to a ‘safe account’. In the ‘police’ version, the person is accused of money laundering and told to cooperate in secret. The sender's number and name can be spoofed, so the message sometimes lands in the same thread as genuine SMS.
The deciding sign is a request to give a password or confirmation code, allow remote access or transfer money yourself to ‘protect’ it. Hang up and dial the number on your bank card or the official website yourself. Contact the police through the published number of the station or in person; do not call back the number from the message.
If you have already given access or a code, call the bank at once: block your cards and online banking, end active sessions, remove trusted devices and dispute the transactions in writing. If remote access was installed, disconnect the device from the internet and change passwords from another device. Ask the bank to recall the transfers and to log your complaint, then report it to the police. For a transaction the customer confirmed themselves, getting the money back is usually harder, but you still need to report the social engineering.
“If it's an SMS, it's scammers, they can disguise numbers as SNS”
Translated from Russian; the original is at the linkpequenos_PT25.06.2026
Spot a swapped IBAN in business correspondence
How the scheme works: the fraudster gets into the email of a supplier, landlord or employee and carries on an existing conversation. Before payment they send an ‘updated invoice’ in which only the IBAN has changed, explaining it by a new bank, an audit or a temporary block on the old account.
The main sign is that the bank details have changed without a procedure agreed in advance. Call the person you know on the number you used before, not the one in the new email. Ask for the account holder's full name and the reason for the change. If the bank shows that the recipient's name does not match the one on the invoice, do not ignore the warning.
After a mistaken transfer, contact your bank and the recipient's bank at the same time: ask for a recall of the transfer and for the remaining balance to be blocked as obtained by fraud. Tell the real supplier that the correspondence has been compromised. For the police, keep the email in its original format with the technical headers, the earlier thread, both accounts, the IBAN and the proof of payment. Screenshots are not enough if you need to establish where the email was really sent from.
Check the car and the seller's right to sell it
How the scheme works: the seller demands a deposit before a viewing, shows someone else's Documento Único Automóvel (single vehicle document), hides a lien or seizure, winds back the mileage or promises to arrange the change of owner later. An imported car may lack the documents needed for registration, and the seller may claim to be an intermediary without a power of attorney.
Compare the VIN on the body, in the Documento Único Automóvel and in the contract. Get a Certidão Permanente Automóvel (permanent extract from the vehicle register): it helps you check the registered owner and any current charges. Look at the IPO — Inspeção Periódica Obrigatória (compulsory roadworthiness test) reports, the service invoices and whether the mileage adds up. Before paying, have the car checked by an independent mechanic. It is safer to pay at the same time as the change of owner at the Conservatória do Registo Automóvel (vehicle registry office) or through Automóvel Online (the online vehicle register).
If you paid but the car was not handed over or cannot be registered, ask for the transfer to be recalled at once and file a report with the listing, the VIN, the seller's details and the contract. If you bought from a professional dealer, also file a complaint through the Livro de Reclamações (complaints book) and go to a Centro de Arbitragem de Conflitos de Consumo (consumer arbitration centre). When buying from a private individual, the consumer procedure usually does not apply: the dispute may need a civil claim.
Recognise fake crypto investments and risky P2P
How the scheme works: an acquaintance, an ‘analyst’ or a bot promises steady high returns, shows profits in a fake dashboard and asks you to send USDT to a given wallet. When you try to withdraw, new payments appear — a tax, insurance, a fee or a deposit. In the P2P scheme, the victim may receive euros from a hacked account: the real owner then disputes the transfer, and the bank blocks the accounts of everyone involved.
The signs are guaranteed returns, transfers to the consultant's personal wallet, no way to withdraw a small test amount, and a demand to pay more to unlock the funds. Check the company in the registers of the CMVM — Comissão do Mercado de Valores Mobiliários (Securities Market Commission). A crypto company's registration with the Banco de Portugal (Bank of Portugal) is mainly about anti-money laundering requirements and does not mean the investment product is approved by the state.
If you have sent cryptocurrency, keep the wallet address and the txid — the transaction ID. Urgently tell the exchange through which the funds were withdrawn the recipient's address and the number of your police report: the exchange can sometimes freeze the assets if they are still in its accounts. Describe the origin of each P2P transfer to your bank honestly and attach the orders, messages and statements. Do not pay ‘crypto recovery specialists’: a request for a new advance payment is often the second stage of the scam.
“Had a p2p exchange, received dirty money. Wrote a text with gpt, told the whole story as it was. There were guys who sorted the issue out, they advised not to lie to the bank and to tell it as it is. Gave a detailed description of the whole situation with screenshots. In the end I told it as it was and the account was unblocked.”
Translated from Russian; the original is at the linkrefugecard24.04.2026
“On my wife's N26 I exchanged crypto from an exchange via P2P, put the whole amount straight onto my N26. A week later N26 sent an email that both accounts would be blocked and gave us until March to withdraw / spend the money. The guy who sent the euros requested a refund of the transfer. Obviously a scammer. I declined the refund request. End result: the balance on my wife's account is close to zero, on my balance that amount is sitting almost untouched (about 1.5k).”
Translated from Russian; the original is at the linkneo_banks14.01.2026
Do not activate a card sent to you by post using a QR code
How the scheme works: an envelope that looks like a letter from a bank is put in your letterbox. Inside is a plastic card with your name and a note saying that your old card has expired and the new one must be activated immediately, or the account will be blocked. You are asked to activate it with a QR code printed right on the letter. The code leads not to the bank but to a detailed copy of its website: the login, password and card details entered there go straight to the fraudsters, and then money disappears from the account. The trick is called quishing — the same harvesting of details as ordinary phishing, only the bait is a QR code rather than a link. The GNR (Guarda Nacional Republicana — National Republican Guard) warned about this scheme on 2 September 2026 and explained why it works: people trust a paper envelope more than an email, and the address behind a QR code cannot be seen in advance — unlike a link, which you can read.
The main sign is that you did not order this card. A bank does not send a card nobody asked for, and never asks you to activate it with a QR code from a paper letter: a real card is switched on in the bank's app, at a branch or at a Multibanco cash machine with the first PIN transaction. The second sign is urgency and a threat: ‘or your account will be blocked’. A real bank does not talk like that.
What to do. Do not scan the code. Call your bank on a number you found yourself — on the back of your current card, in the app or on the bank's website typed in by hand; the number from the letter you were sent will not do, as it may also be fraudulent. Do not throw away or cut up the card and envelope before the call: they are evidence for the bank and for the police. Reports are made to the GNR or the PSP (Polícia de Segurança Pública — Public Security Police), and if you did manage to enter your details — call the bank first: block the card and online banking access, change your password, and then make the report. How to block cards and order replacement documents is explained in the gov.pt guide ‘Perda ou roubo da carteira’ — it is about losing your wallet, but the steps are the same.
As of 2 September 2026 nobody in our chats had described this scheme yet — it has only just appeared. But fake letters ‘from the bank’ have been arriving for a long time, and they have the same sign: a bank or service you have no relationship with.
“#scammers We got a letter like this. Just so you know, we don't have an account with this bank. But someone might well have one.”
Translated from Russian; the original is at the linkRussosEmPortugal12.10.2024
“⚠️ Careful: scammers are active again (and this time, it seems, with my number…) A call. PayPal. ‘Confirm a payment of...’ 🤨 Stop. I have never used PayPal in my life. I don't buy anything through it at all. Phone on silent, but I feel something is wrong. I hang up. The next day — another call, a different amount. Today — a missed call in the morning. I call back. The woman at the other end says: ‘I've just had a call from your number saying I need to pay PayPal… But I've never used it…’ 😳 So someone is using MY number.”
Translated from Russian; the original is at the linkRussosEmPortugal27.06.2025
“After the email from bls saying my passport was ready and had been sent, about an hour later scammers called me pretending to be a courier. They called me by my full name. At first I didn't realise, we agreed on the time the passport would be delivered and to confirm delivery they asked me to give the code from an SMS) the SMS came from Pochta Bank. I didn't fall for it, but be careful!”
Translated from Russian; the original is at the linkPortugal 🇵🇹 TravelAsk chat16.11.2025
In a car park they demand money for a car you ‘hit’ — do not pay on the spot
How the scheme works: a car follows you from a supermarket car park, flashes its lights or hoots, you are stopped and politely told that you hit it. They show a scratch or a broken mirror — the damage was most often already there. Sometimes a woman or a child is sitting in the car: it makes them more trustworthy. Then the rush begins: let's settle it here, why do we need the police and the insurers. They ask for cash, take you to a cash machine, haggle and lower the amount themselves so that you feel they are meeting you halfway.
GNR figures for the first half of 2026: 30 reports against 26 in the same months of 2025 (up 15.4%), losses of €72,540 — almost as much as for the whole of last year (€77,480); in one case a person lost €15,450. Most cases were in the district of Faro — six, followed by Lisbon, Porto, Viseu and Beja. The GNR explains the size of the losses by the fraudsters getting hold of the victims' cards and PIN codes themselves, rather than just taking cash, and expects 2026 to end up noticeably higher than last year (GNR statement via Lusa, 28 August 2026). The choice of victim is stated plainly: drivers over 60 — counting on fear of a dispute and being unused to electronic payments. The PSP sees the same picture: 853 reports in five years, 78% more in 2025 than a year earlier; 40% of victims are people aged 70–79, another 39% are 80 and over; most often between 10 am and 4 pm and where there are no cameras (PSP figures, March 2026).
What to do. No money on the spot: not in cash, not by card, not at a cash machine. Do not let the card out of your hands, do not give your PIN. Photograph both cars, the number plates and the damage, ask for the other party's documents and insurance policy, fill in a declaração amigável (amicable declaration — the form used in Portugal for an accident with no injuries) and go your separate ways. How to fill it in is shown in the ACP guide, and what to do after an accident in the brochure from the ASF, the insurance supervisor. If the person is rushing you, refuses to fill in the form or pulls you towards a cash machine — call the police: this is exactly the case when you call them. More on policies and payouts in the guide Car insurance in Portugal: what it covers, how much it costs and what to do after an accident, and how to make a report in the guide What to do after a theft, burglary or assault in Portugal.
There is a discrepancy worth showing here. The GNR advises calling the police if you are suspicious, while the chats say the opposite — that you should not call the police to an ordinary accident with no injuries and you may be fined for it (December 2024). There is no contradiction: a declaração amigável is enough when both sides agree and calmly fill it in; the police are needed precisely when the other side refuses the form, demands money on the spot or puts pressure on you. Conversations in the chats also show the cost of trying to ‘settle with cash’ without paperwork: a verbal agreement easily turns into mutual accusations later.
“The disagreements came later When the girl who drove into my back called her mum and she started saying I was extorting money 😂 I was FOR the declaração amigável, but the girl asked if we could go our separate ways without a report, just splitting the repair costs.”
Translated from Russian; the original is at the linkmoto chat 🇵🇹28.07.2026
“For the insurer it's enough to fill in and sign a declaração amigável. If you call the police to an accident with no injuries, you may get a fine.”
Translated from Russian; the original is at the linkautolife_pt27.12.2024
“Both sides fill in the declaração amigável (one you, the other the second driver), carefully draw the diagram, both drivers sign and you go your separate ways. Within 10 days hand the declaration in to your insurer, they'll take it from there.”
Translated from Russian; the original is at the linkautolife_pt05.05.2024
What it costs, according to community conversations
| losses from bank SMS | about €100,000 and almost €1 million in two investigations | source |
| losses from fake investments | at least €73,000 in total; one loss of more than €20,000 | source |
| theft from clients by a lawyer | €1.2 million | source |
| bank SMS scam | €100,000 | source |
| investments via Wise | €73,000 | source |
| loss of one Wise victim | more than €20,000 | source |
| fake criminal record certificate | €200 | source |
| cash in the IPTV scheme | over €100,000 | source |
What changed
- 2 September 2026 — added the scheme with a card by post and the scheme with a staged accident in a car park
- 28 August 2026 — corrected the link to the arbitration centres: the old address led to the home page of the consumer affairs directorate
- 28 August 2026 — added a link to the guide on the complaints book (Livro de Reclamações)
What to bring
- the applicant's identity document and contact details
- bank statement and proof of transfer
- IBAN, the recipient's name and their bank's details
- messages, voice messages and call log
- original emails with headers
- screenshots of the listing and the page address
- contract, invoice, receipt or job offer
- Certidão Permanente Predial (property extract)
- Certidão Permanente Comercial (company extract)
- Documento Único Automóvel (vehicle document)
- Certidão Permanente Automóvel (vehicle extract)
- VIN, diagnostic results and roadworthiness test documents
- crypto wallet address and transaction txid
- bank complaint number and police report number
- the envelope, the letter and the card you were sent — do not throw them away before calling the bank
- photos of both cars, the number plates and the damage, and the completed declaração amigável
Where people most often trip up
- Paying a rental deposit up front does not in itself mean fraud — what matters more is the link between the recipient, the owner and the contract.
- A contract and insurance do not prove that the employer will actually pay your wages.
- A real bank does not ask you for a confirmation code or to move money to a ‘safe account’.
- A familiar SMS thread and the sender's displayed number can be faked.
- After a long exchange of emails, fraudsters sometimes change only the IBAN on an invoice.
- A vehicle document must be checked against the VIN and an up-to-date register extract.
- With P2P, the bank may block not only the transfer received but also linked accounts.
- A promise to recover cryptocurrency for an advance payment often turns out to be a second scam.
- Deleting messages does not delete the bank's records — keep the statement and the exact time of the transaction.
- The later the bank learns about a transfer, the lower the chance of blocking the balance in the recipient's account.
- A bank does not send a card you did not order, and does not ask you to activate it with a QR code from a paper letter.
- A demand to pay on the spot for a car you supposedly ‘hit’ in a car park is a reason to call the police, not to look for a cash machine.
How it went for people
A fake account copied a channel and its photo
The owner of a channel found a comment with links under her post from a fake account that had copied her channel's photo and name. The fake was given away by the missing description and a different name the comments were posted under. The account was blocked, and readers were asked not to follow its links.
A malicious game stole half a million euros
A man followed a link on social media and downloaded a file posing as a computer game. Malware was installed on his device, after which the criminals withdrew about €500,000 from several crypto wallets. The investigation took several months: the police traced the chain of transactions, seized the money and returned it to the owner in full.
A fake bank refused to speak Portuguese
A man received a Viber call to his Ukrainian number, supposedly from a bank, warning him it was his last chance to update his details before his card was blocked. He was not a customer of that bank, but he called back and asked which country he needed to update the information in. When he asked to continue the conversation in Portuguese, the caller hung up. About a month earlier he had received a similar call supposedly from another financial service.
A doula left at a hard moment in labour
A woman hired a doula after a traumatic first birth, counting on support from start to finish. During her second birth the epidural did not work, but the doula left with the mother's permission and then got updates on her condition through messages from the husband. When she was fully dilated, the husband asked the doula not to come after all, as she would not make it in time; the vacuum delivery and pushing took 20 minutes. In the end the woman was left without the support she expected at the hardest moment and felt cheated.
A suspicious invitation turned out to be a real TV shoot
A woman received an invitation to appear on Portuguese television and at first thought someone was trying to draw her into a pay-to-appear scheme. She asked why they had approached her in particular and found out that the editors were preparing a programme on emigrants' health and were looking for a specialist. She was sent instructions on how to prepare, after which she went to the shoot and took part in a conversation with a cardiologist. In the end the invitation was genuine, and the episode was due to be scheduled later.
Retold in our own words from messages in open chats. The link leads to the full original message.