Portugal

A Free Address Undermines a Credible Business

A client, supplier, or bank that receives an invoice from a free personal mailbox reads it as improvised, not professional. In Portugal's business environment, a domain-matched email address is one of the simplest signals that a company is properly established and worth trusting with a contract. Professional email is a small investment that pays back in credibility every time a message is opened.

CEO Fraud and Phishing Are Portugal's Leading Attack Vector

Portugal's National Cybersecurity Centre (CNCS) confirms that fraudulent email is the primary entry point for attacks on Portuguese businesses, responsible for more incidents than technical vulnerabilities or brute-force attacks combined. CEO Fraud and business email compromise made up 18% of all social engineering incidents reported to CERT.PT in 2025, with attackers impersonating executives to request urgent transfers, sending fake invoices, or asking to change a supplier's IBAN. The CNCS's 2025 report also recorded a 36% year-on-year rise in overall cyberattacks to 2,758 incidents, and a 136% jump in vishing (phone-based phishing) specifically, with the "unpaid invoice" scam targeting accounting departments growing every quarter.

Unverified Domains Get Sent to Spam or Blocked

Mailbox providers score every sending domain before a message reaches an inbox. A domain without SPF, DKIM, and DMARC authentication looks unverified to these filters and gets routed to spam or blocked outright, regardless of how legitimate the sender is. Every quote, invoice, or follow-up lost this way is business the company never knew it lost.

Portuguese and EU Rules Now Directly Cover Business Email

As an EU member state, Portugal applies the GDPR alongside national implementing legislation, enforced by the Comissão Nacional de Proteção de Dados (CNPD). Since April 2026, the NIS2 Directive has also been in force in Portugal under DL 125/2025, making documented phishing-awareness training a legal requirement for companies in critical sectors, with mandatory notification to the CNCS within 24 hours when personal data is compromised. Business email, where customer records, contracts, and payment instructions are exchanged daily, sits squarely within both frameworks.

What to Do Right Now

Every week spent on an unverified or personal mailbox adds to the risk of CEO fraud, blocked mail, and impersonation. Portuguese businesses should move to a verified company domain, implement SPF, DKIM, and DMARC authentication, and require phone verification for any payment or IBAN change requested by email. UCN Mail is built to make that shift straightforward — professional email with the authentication, security, and reliability a Portuguese business needs to be trusted and reach the inbox.

Over Half of Portuguese PME Suffered a Cyberattack Last Year
The Hiscox Cyber Readiness Report 2025 found that more than half of Portuguese SMEs suffered at least one cyberattack in the past year, often repeatedly, and CERT.PT attributes roughly 84% of incidents to phishing, up 13% in 2024. The most damaging pattern targeting Portuguese businesses directly is the "fatura em aberto" scam — a fake overdue-invoice email, often nearly indistinguishable from the real thing, typically sent from a subtly altered domain. A properly authenticated business domain makes that kind of lookalike spoofing significantly harder to pull off.

CEO Fraud Exploits a Gap Few Businesses Have Closed
Portugal's National Cybersecurity Centre and Polícia Judiciária have issued repeated 2025 alerts about "fraude do CEO" — an attacker impersonating a director or supplier to push an urgent bank transfer or IBAN change — and Cisco data suggests only 9% of European businesses have the maturity to reliably catch it. A Mastercard study found 17% of Portuguese business owners had already been directly targeted by fraud, with 12% suffering real financial losses.

PDF Invoices Stay Legal a While Longer — But the Countdown Has Started
Portugal's Decree-Law 13-A/2025 pushed the deadline for micro, small, and medium businesses to adopt structured CIUS-PT invoicing to December 31, 2026, meaning PDF invoices remain valid a little longer than originally planned. Fewer than half of Portuguese PME currently have electronic invoicing in place, according to Sovos Saphety, which means many businesses still have real preparation work ahead — and secure, professional email remains the backbone of the correspondence around every invoice in the meantime.

A Free Gmail or Sapo Address Still Looks Unfinished
Many small Portuguese businesses run client communication through a personal Gmail or Sapo address, which can look informal next to a competitor emailing from [email protected]. A domain-matched address is a small, low-cost way to look as established as the business actually is.

Getting Started: What You'll Need
Have your domain name ready (or one to register), a short list of who needs a mailbox, and about 15–20 minutes to update your domain's DNS records with your registrar. UCN Mail handles domain verification and authentication setup, so your invoices and client correspondence land reliably — and are far harder for a scammer to convincingly spoof.