Unexpected bank card in the post? Banco de Portugal says stop and check
Banco de Portugal has warned that criminals are posting convincing fake bank cards with urgent activation instructions.
Archived after its publication day. Search retains this original briefing for background and accountability.
Archived 12 September 2026A personalized letter, familiar bank name or realistic card does not prove the mailing is genuine.
- Do not use a phone number, link or QR code printed in the unexpected letter.
- Activate a genuine card only through an ATM or the bank's official site or app.
- Contact the bank through a channel you already know if the card was not expected.
The letter can contain real personal details
Criminals may already know a person's name, address and bank, allowing them to create a convincing mailing. Urgency, a threat to block the account or a request to scan a QR code are reasons to stop.
Banks normally send replacement cards before the existing card expires. That process does not require activation through a link or contact supplied in an unexpected letter.
Break the attacker's contact path
Open the bank app independently, type the known website address or use the number on an existing statement or card. Do not confirm details through the suspicious letter.
If information has already been entered or money moved, contact the bank immediately, preserve the letter and digital evidence, and report the incident through the appropriate police channel.
What you can do now.
- 01
Check the current card's expiry date.
- 02
Contact the bank through a known independent channel.
- 03
Report quickly if information or money has been exposed.
Have a place we should experience?
Invite the Hub for a hosted visit, propose a story, plan a clearly labelled campaign or apply for a business profile.