Dozens of Banco CTT customers have reportedly lost thousands of euros through transfers they say they did not authorise. Portugal’s Polícia Judiciária (PJ) is investigating the complaints, which have also raised questions about banks’ responsibilities when customers are targeted by phishing and social-engineering scams.

One customer filed a complaint with the Bank of Portugal seeking the return of €1,200. In her account, someone requested codes to install the bank’s app on an unknown phone. Five subsequent transfer attempts to Spanish IBANs were returned, but she says the remaining funds were later moved first to an associated account and then to an Italian IBAN.

The complaint also refers to a suspicious credit application and a transfer made at an unusual time. The customer argues that the bank should have blocked the account and contacted her, but says it did not do so.

Asked by Correio da Manhã about individual cases, Banco CTT declined to comment, citing banking secrecy and data protection. The bank acknowledged an increase in phishing and social-engineering campaigns and said it is strengthening fraud prevention and monitoring. It also said it has stepped up customer warnings through text messages, app notifications and email.

The report also cites a Court of Justice of the European Union ruling dated 15 October 2026. It says that, in principle, a bank must reimburse a customer for an unauthorised payment immediately and no later than the end of the next business day after learning of it or being notified, provided the customer reports it without undue delay.

According to the ruling as described in the report, a bank cannot refuse reimbursement solely because it believes the customer acted with gross negligence, such as entering credentials on a fake website. After reimbursing the customer, however, the bank may seek to recover the money if it proves the customer acted intentionally or with gross negligence. The report says reimbursement may be suspended only where there are reasonable grounds to suspect the customer committed fraud, and the bank must explain those grounds in writing to the competent national authority.

Banco CTT did not clarify whether it intends to apply this rule to the affected customers.

Sources: Pplware.