How to Report Cybercrime in Portugal (and Get Your Money Back)
A practical guide for victims of online fraud and cybercrime in Portugal: who to call, how to report to the Gabinete de Cibercrime and Policia Judiciaria, and how the PSD2 unauthorised-payment refund (with its EUR 50 cap) actually works.
Quick answer: If you are in immediate danger or a crime is happening now, call 112 (the single European emergency number). Report cybercrime to Portugal's Public Prosecution Service by emailing the Gabinete de Cibercrime at [email protected], or file a criminal complaint with the Policia Judiciaria (national cybercrime unit, UNC3T). Then call your bank's fraud line immediately to freeze the account and flag the transaction. Under PSD2 (transposed by Decreto-Lei 91/2018), if a payment was made without your authorisation, your bank must refund it and your own liability is capped at EUR 50, unless you acted fraudulently or with gross negligence.
What to do in 3 steps
- Call your bank now. Phone the fraud or emergency line printed on your card or in your banking app. Ask them to block the card or account, stop or recall the payment, and log the transaction as unauthorised. Note the date, time and name of who you spoke to.
- Report the crime. Email the facts to the Gabinete de Cibercrime at [email protected], or go in person to a Policia Judiciaria office (the UNC3T handles cybercrime). A formal criminal complaint must include your identification and signature, so keep a copy of what you submit.
- Escalate if the bank refuses. If your bank will not refund an unauthorised payment, file a complaint with Banco de Portugal through the Portal do Cliente Bancario. Keep every receipt, message and reference number.
How recovery actually works
Speed decides almost everything. The moment you tell your bank a payment was unauthorised, the law stops you bearing any further losses (short of fraud or gross negligence on your part), and the bank is required to refund the unauthorised amount, in principle by the end of the next business day. If the bank suspects you authorised or caused the loss, it can investigate before refunding, which is why a clear, early report matters. For a payment you were deceived into making yourself, there is no guaranteed refund, but a bank contacted within minutes can sometimes recall funds before they are withdrawn, and the receiving bank may freeze the destination account. In parallel, your criminal complaint to the Gabinete de Cibercrime or Policia Judiciaria creates the official record investigators and your bank may rely on. Recovery is never guaranteed, but reporting fast and in writing gives you the strongest position.
What to have ready
- Your bank account or card number and the exact amounts, dates and times of the disputed transactions.
- Transaction references, IBANs or account details of where the money went, if you have them.
- Screenshots of messages, emails, fake websites, ads or caller IDs used by the fraudster.
- Any one-time codes, links or attachments you received or were asked to enter.
- Your own identification (citizen card or passport), needed for a formal criminal complaint.
- A short written timeline of what happened, in the order it happened.
Frequently asked questions
Do I have to report to the police to get a bank refund? For an unauthorised payment, your refund right under PSD2 comes from notifying your bank, not from a police report. But reporting to the Gabinete de Cibercrime or Policia Judiciaria is strongly advised: it creates an official record, helps the investigation, and supports your case if the bank disputes the claim.
What if my bank refuses to refund an unauthorised payment? You can complain directly to Banco de Portugal through the Portal do Cliente Bancario. Banco de Portugal supervises retail banking conduct, including cards, transfers and payments, and there is no cost to file. The bank has 20 business days to respond.
I authorised the transfer myself after being tricked. Can I still get my money back? There is no automatic legal refund for an authorised payment, even if you were deceived. Contact your bank immediately anyway, because a fast recall request can occasionally retrieve funds, and report the scam to the Gabinete de Cibercrime so it is on record.
Sources
- Gabinete de Cibercrime, Procuradoria-Geral da Republica (reporting via [email protected])
- Policia Judiciaria, Unidade Nacional de Combate ao Cibercrime e a Criminalidade Tecnologica (UNC3T)
- CNCS / CERT.PT, national CSIRT incident notification
- Banco de Portugal, PSD2 (DSP2) frequently asked questions and complaints
- Decreto-Lei n.o 91/2018, transposing PSD2 into Portuguese law
For step-by-step reporting and recovery guides covering other countries, see our cybercrime help hub.