France is gearing up for e-invoicing: since 1 September 2026, every business must be able to receive electronic invoices, and small and medium-sized businesses will have to issue them from September 2027. Portugal took a different route, and earlier. Rather than routing invoices through platforms, it controls the software that produces them. The result: every Portuguese invoice carries a unique code and a QR code anyone can read. And yet one simple rule has held out since 2019: signing invoices sent as PDFs.
How does the Portuguese tax authority check invoices?
Through four mechanisms, introduced in successive layers.
Certified software. A 2010 ministerial order introduced prior certification of invoicing software by the tax authority. In it, each invoice is signed electronically with an RSA key, and the signature covers, among other things, the date, the number, the total amount… and the signature of the previous invoice of the same type and series (Portaria n.º 363/2010). The invoices therefore form a chain: you cannot delete or insert one without breaking it. Certified software is now compulsory for businesses that meet at least one condition: turnover above 50,000 euros in the previous year, organised accounts, or simply invoicing with software. Since 1 July 2025, they may instead use the free invoicing applications provided by the tax authority, the AT (Autoridade Tributária).
Monthly reporting. Since 2013, the data of every invoice has been reported to the tax authority, which displays it on its e-Fatura platform. For invoices issued since 1 January 2023, reporting must take place by the 5th of the following month at the latest, in real time through a web service, through a file based on the SAF-T (PT) format, or by direct entry on the Portal das Finanças, the tax authority's website (Portal das Finanças).
A unique code, the ATCUD. Since 1 January 2023, each series of invoices has been declared to the AT before use; the AT returns a validation code, and every invoice carries, on every page, an identifier in the form "ATCUD:CodigodeValidação-NumeroSequencial" (Portaria n.º 195/2020, Portal das Finanças).
A QR code, compulsory since 1 January 2022 on invoices and other tax documents issued by certified software (OCC, Portal das Finanças).
What does the QR code on a Portuguese invoice contain?
The essentials of the invoice, in machine-readable form. The technical specifications published by the AT list the mandatory fields (Autoridade Tributária):
- the seller's tax number and the buyer's, with the buyer's country;
- the document type, its status, its date and its identifier;
- the ATCUD;
- the total tax and the invoice total;
- four characters of the invoice's electronic signature;
- the certificate number of the software that produced it.
Added to these are the tax region and, where applicable, the taxable amounts and VAT for each rate, as well as an optional free-text field where the seller can give payment details, an IBAN for example. Each field takes the form "code:value", separated from the next by an asterisk, and the code must measure at least 30 millimetres a side.
The AT gives it two purposes: making it easier for individuals to report invoices, which they use for expenses deductible from income tax, and strengthening checks against the informal economy and fraud (Autoridade Tributária). The customer, or an inspector, can read the key data in an instant and compare it with what is printed. And an invoice produced outside certified software matches nothing the tax authority has received: no declared series, no reported invoice. The QR code alone does not guarantee authenticity, since anyone can generate one, but it makes forgery more laborious and easier to spot during an inspection.
Spain is heading down a similar path with its VeriFactu system, which we cover in the Spanish episode.
And invoices sent as PDFs?
This is the Portuguese paradox. A 2019 decree-law requires an electronic invoice to guarantee the authenticity of its origin and the integrity of its content; it treats both as guaranteed where there is a qualified electronic signature, a qualified electronic seal or electronic data interchange (OCC). A plain PDF sent by email meets none of these conditions.
Since the end of 2020, the entry into force of this requirement for PDFs has been pushed back year after year: first by ministerial decisions, then by budget laws (OCC, Marcaweb). The 2026 budget law provides: "Até 31 de dezembro de 2026 são aceites faturas em ficheiro PDF, sendo consideradas como faturas eletrónicas para todos os efeitos previstos na legislação fiscal", until 31 December 2026, invoices in PDF files are accepted and treated as electronic invoices for all purposes under tax legislation (Lei n.º 73-A/2025, article 95.º, n.º 3).
In law, then, the qualified signature requirement applies from 1 January 2027. But the 2027 budget bill, tabled in Parliament on 8 October 2026, provides for a further one-year postponement, repeating the same wording with the date of 31 December 2027 (OCC, Marcaweb). The final overall vote is scheduled for 24 November 2026, and the text may change before then; it will then have to be promulgated and published. A Portuguese web services provider sums up the approach: the State postpones the requirement "um ano de cada vez", one year at a time.
Why so much resistance? The sources consulted give no official explanation. The difficulty, however, is plain to see: signing every invoice with a qualified certificate requires equipment and a subscription that many small businesses do not have, even though control at source, through certified software and monthly reporting, already exists.
Has the system put an end to scams?
No. They have shifted to impersonating the tax authority itself. In 2021, the AT warned about emails carrying an attachment named "PortaldasFinancas.pdf" or "Finanças.pdf", which asked the recipient to click a link: "Em caso algum deverá abrir o ficheiro em anexo e efetuar essa operação", under no circumstances should you open the attachment or carry out this operation (Portal das Finanças). Warnings have followed one another ever since, with the same wording, "Estas mensagens são falsas e devem ser ignoradas", these messages are fake and should be ignored; in July 2026, a fake email targeted the self-employed over unissued "green receipts", the recibos verdes freelancers issue (Portal das Finanças, Observador).
Phishing remains the most common type of incident handled by the national incident response team, CERT.PT: 790 phishing incidents by email or text message in 2024, nearly 29% of the total (Tek Sapo). Invoices, for their part, remain the target of fake bank details fraud, as everywhere. The QR code can indeed carry an IBAN, in its free-text field, but it is the seller who puts it there: on a forged invoice, it will say whatever the fraudster wanted.
What can a French entrepreneur take from this?
Control at source has not killed off the PDF. Even in a country where every invoice is chained, coded and reported to the tax authority, the PDF remains the everyday exchange format, for want of a signature that is simple to roll out. In France, an electronic invoice within the meaning of the reform is a structured file (Factur-X, UBL or CII) that passes through an approved platform; a PDF alone will no longer be enough for small and medium-sized businesses in September 2027 (see Your first invoice in France and our article on e-invoicing).
A QR code on an invoice is not proof. In Portugal, it is regulated by the State; elsewhere, it can lead anywhere. Before scanning a QR code on an invoice you have received, check where it leads, as we explain in QR code phishing in PDFs.
An attachment that imitates the tax authority should be inspected before it is opened. Inspect PDF detects in it, in your browser and without sending it to a server, active mechanisms (JavaScript, automatic actions on opening, program launches, attached files) and flags the presence of links, without showing their addresses. It does not read QR codes or verify signatures; a file with no indicators may still contain a phishing link.
PDFKami does not produce invoices, applies no signature or seal and does not read Portuguese tax QR codes; it is for inspecting and preparing PDFs without uploading them.
Glossary
AT (Autoridade Tributária e Aduaneira): the Portuguese tax and customs authority.
Certified software: invoicing software approved by the AT, which signs and chains every invoice.
ATCUD: unique document code, combining a series validation code issued by the AT and the invoice number.
e-Fatura: the Portuguese tax authority's platform where the data of invoices reported by businesses appears.
Qualified electronic signature: the highest level of electronic signature under the European eIDAS regulation, the legal equivalent of a handwritten signature.
SAF-T (PT): standard audit file for tax, which Portuguese businesses produce from their software.
Inspect a suspicious attachment without uploading it: PDFKami, in your browser.