Fake IRS refund emails are promising thousands of euros
Judicial Police have warned about messages that imitate the Tax Authority, promise an unusually large refund and send the recipient to a false authentication page.
Archived after its publication day. Search retains this original briefing for background and accountability.
Archived 12 September 2026A convincing tax message can expose login details and financial information. Check a refund by opening the official Finance Portal yourself, never through an email button.
- The fraudulent emails use the Portuguese subject line 'Reembolso de 2025 Aprovado'.
- They promise refunds between €3,936 and €7,989 within three working days.
- The message creates pressure with a deadline and a threat that the service will be suspended.
- Do not click the authentication button or enter credentials on the linked page.
How the message tries to look genuine
The email copies the language and visual cues of a tax notice. It claims that a 2025 refund has been approved, gives a large amount and offers a button to begin authentication. It then adds urgency by saying the process must be completed before a deadline or access may be suspended.
Those details are designed to make the recipient act before checking. The promised amounts range from €3,936 to €7,989, and the message says the money will arrive within three working days. Judicial Police say the message is fraudulent.
Check without using the email
Do not click the button, reply or provide a password, tax number, bank detail or authentication code. Open a fresh browser window and type the Finance Portal address yourself, or use the official app you already have installed. A genuine refund and any request requiring action should be checked inside your authenticated account.
If you entered credentials through the message, change the relevant passwords from a trusted device and contact your bank if financial information was exposed. Keep the email and screenshots for a report, but do not forward the live link to other people.
What you can do now.
- 01
Delete the message if you have not interacted with it.
- 02
Check your tax position only through the Finance Portal opened independently.
- 03
Change exposed credentials and contact your bank promptly if you submitted financial information.
Have a place we should experience?
Invite the Hub for a hosted visit, propose a story, plan a clearly labelled campaign or apply for a business profile.
Get clear on what has changed—and what to do next.
Book a private 30-minute session with one of our experts to understand how the update may affect your plans, what needs checking and whether you need specialist advice.
View sessions and request a time ↗