Brazil

Scams in Brazil reach every group. In the Senate's survey the people who lost money were split evenly between men and women and spread across ages and incomes much as the population is: 27% were aged 16 to 29 and 16% were 60 or over. In police reports of digital bank fraud collected by the Ministry of Justice, six in ten victims were aged 30 to 59, and women were 51%.

Those reports show how scammers make contact: a phone call is mentioned in 164,725 of 364,658 reports and WhatsApp in 155,437, far ahead of Facebook (44,292), email (36,189), Instagram (30,132) and SMS (17,700). The usual scripts are a caller posing as the bank's security team, who cites real personal data and a suspicious purchase and has the victim move money to a 'safe account' or hand a card to a courier; a WhatsApp message from a new number carrying a relative's photo and asking for urgent money; and a text about a problem with the victim's CPF tax number with a link. A stolen phone is another way in.

Phone scams in Brazil grew out of calls made from inside prisons. Police now find staffed call centres: one closed on São Paulo's Avenida Faria Lima in January 2026 had about 100 workers and more than 400 computers. Investigations link the two largest criminal factions, the PCC and the Comando Vermelho, to scam operations.

Most stolen money leaves by Pix, the central bank's instant payment system, used by more than 170 million people. Fake boletos (payment slips) and cloned cards are the other routes. The money lands in 'contas laranja', accounts lent or opened in other people's names, and is passed on within minutes.

The central bank's safeguards sit on both ends of a payment. Transfers between individuals from 8 pm to 6 am are capped at R$1,000 per account, and a request to raise a limit takes at least 24 hours. Since November 2024 a Pix from a device the customer has not registered is limited to R$200, and R$1,000 a day. A receiving bank can hold a suspect payment for up to 72 hours. When banks confirm a fraud, the account holder's tax number and Pix key are marked in a shared directory, the bank must refuse all Pix to and from that account, and a September 2025 rule makes every bank reject payments to accounts under well-founded suspicion. The free BC Protege+ service, announced in December 2025, lets anyone bar new accounts in their name.

On the phone side, Anatel has made operators block callers who place mass short calls: more than 248 billion calls were stopped in four years and almost R$40 million in fines applied. The Ministry of Justice's Celular Seguro app lets the owner of a stolen phone block the line, the handset and bank apps with one alert.

Pix, the central bank's instant payment system, carries the most visible losses. Banks confirmed fraud on Pix payments worth R$7.77 billion in 2025, and R$24.5 billion from January 2022 to April 2026. Febraban, the banks' federation, put losses to fraud and scams at R$10.1 billion in 2024, up from R$8.6 billion in 2023, with card fraud the largest part.

Fraud keeps rising in police records, which carry no loss figure. The state civil police recorded 2,261,055 cases of estelionato, the general fraud offence, in 2025, up 3.1% on 2024 and more than five times the 426,799 of 2018.

Losing money is common. In June 2024 DataSenado, the Federal Senate's research institute, found that 24% of people aged 16 and over had lost money to a digital crime in the previous 12 months.

Little of the money comes back, and most of what does is taken back from the accounts that received it. Pix, the central bank's instant payment system, has a refund route, the Mecanismo Especial de Devolução (MED). In 2025 banks accepted fraud claims on Pix payments worth R$7.77 billion and returned R$696.1 million through it, according to the central bank's MED statistics. R$4.06 billion could not be returned because the receiving account was empty. A further R$1.38 billion held by receiving banks for up to 72 hours on suspicion of fraud was sent back to the payer.

The victim contests the payment in the bank's app within 80 days, the money left in the receiving account is blocked, and the receiving bank has seven days to analyse the case. The central bank states that the MED does not guarantee a refund: it depends on the banks confirming fraud and on a balance remaining. Commercial disputes and a Pix sent by mistake are not covered. Since February 2026 banks must trace the money beyond the first account, and the share of accepted claims returned has risen since.

A refused victim can go to court. Under Súmula 479 of the Superior Tribunal de Justiça, banks answer for fraud by third parties in banking operations even without fault, unless the customer alone caused the loss.

Police recorded 2,261,055 fraud reports (estelionato) in 2025, up 3.1% from 2,193,122 in 2024 and more than five times the 426,799 of 2018. In the 24 states that count it separately, electronic fraud reports rose from 286,226 to 346,753. Victims report at a Civil Police station or at the online police station that each state and the Federal District runs. Criminal proceedings rose from 52,649 to 63,771 in 2025, 2.8% of the reports. The national base of police reports holds 119,573 reports of digital bank fraud for 2025, up from 79,748 in 2024.

Far more victims go to their bank. Customers contested 22.2 million Pix payments through the central bank's refund mechanism (MED) in 2025, up from 12.3 million in 2024. Monthly contests rose from 1.2 million in September 2025 to 3.5 million in October, when a contest button reached every bank's app. Banks accepted 3.9 million contests as fraud in 2025, worth R$7.8 billion, against 4.9 million worth R$6.7 billion in 2024. Each contest is recorded in the Pix directory, and where both banks find well-founded suspicion the person and the key carry a fraud marker that every institution sees.

A complaint the bank does not resolve goes to its ombudsman and then to the central bank, which has the bank answer it and uses complaints in supervision and in its quarterly complaints ranking. Matters the central bank does not regulate go to the consumer site run by the National Consumer Secretariat with the state Procons.

The figure shown is the number of estelionato cases recorded by the civil police of Brazil's 26 states and the Federal District in 2025, compiled from the state security secretariats by the Fórum Brasileiro de Segurança Pública: 2,261,055. Estelionato is the general fraud offence, so the count covers fraud of every kind, in person and online, including fraud against businesses. São Paulo recorded 833,277 cases, 37% of the total and the highest rate, 1,808 per 100,000 people. The 346,753 cases of electronic fraud leave out São Paulo, Rio de Janeiro and Ceará, which do not separate them. A Ministry of Justice dashboard built on the national base of police reports counts 119,573 digital bank frauds in 2025, without six units including São Paulo.

Few reports go further. Courts opened 63,771 criminal cases for estelionato in 2025, 2.8% of the reports, and 4,819 people were in prison for it. Until April 2026 most cases could proceed only if the victim formally asked within six months; that rule has been repealed.

The basic penalty is one to five years. Electronic fraud carries four to eight, raised by up to two thirds when a server abroad is used and by up to double when the victim is elderly. The Federal Police ran more than 1,000 operations against cybercrime in 2024, against just over 300 in 2022.

Goods paid for online and never delivered are the most common loss: 53% of people who lost money to digital fraud in a 2025 survey for the Fórum Brasileiro de Segurança Pública, ahead of Pix or fake boleto scams (43%), credit card fraud (24%) and investments made after an online advertisement (22%). In a survey for the banks' federation published in June 2025, the scams people had most often suffered were card cloning or card switching (45%), the WhatsApp scam (34%), the false bank call centre (31%), the Pix scam (24%), misuse of the CPF tax number by SMS (13%) and fake auctions or shops (10%).

In card switching, the victim is handed back a similar card after a purchase while the criminal keeps the real one and the PIN. In the WhatsApp scam a contact's photo and name appear on a new number, or the real account is taken over with its verification code. The false call centre poses as the bank's fraud team and has the victim give codes, install remote access software or transfer savings to a 'safe account'. 'Pix scam' covers any of these when the money leaves by Pix, along with altered receipts and swapped QR codes.

By money, the same Fórum survey found the largest average losses in fraud on a bank account (R$3,448) and on credit cards (R$1,690), then Pix or fake boleto scams (R$1,198), investments (R$717) and undelivered goods (R$446).

Brazil has strong rules for one part of the chain and little that joins the parts. The central bank regulates Pix closely: device limits, shared fraud markers, a duty to refuse payments to suspect accounts, and since 2026 tracing of stolen money across accounts. The Ministry of Justice's alliance with the banks' federation brings in 14 public bodies and 11 industry associations, including the telecom operators', and its first wave, to April 2026, delivered a victim guide, a common typology of fraud, a public dashboard and the BC Protege+ block on account opening. The Federal Police and the banks share data through a platform called Tentáculos.

But the pieces stay separate. Victims report to their bank and, separately, to the police of their own state, the government's guide gives no single number or portal, and automatic passing of police reports to banks is scheduled only for 2026 to 2027. Duties in law fall on banks. Operators must block mass short calls, and the removal of fake profiles and advertisements by platforms rests on a protocol in the plan, not on law.

The results are poor: recorded fraud has risen every year since 2018, under a tenth of the money confirmed stolen through Pix is returned, and 2.8% of police reports reach a court. The loss stays with the victim unless a judge finds the bank at fault. The Fórum Brasileiro de Segurança Pública describes near total impunity and a response split between police, banks, platforms, operators and regulators.