[REVISION HISTORY]

Escalating digital fraud and evolving liability in BR

40 recorded revisions of this situation.

What changed

2026-11-03 15:32 UTC → 2026-11-05 04:53 UTC · added ~~removed~~

Brazil’s digital fraud landscape is intensifying, driven by sophisticated social engineering and AI-powered tactics. In late 2026, a study by CNDL, SPC Brasil, and Offerwise revealed that 31% of consumers—approximately 11.6 million people—fell victim to financial fraud in the preceding 12 months. Criminal tactics include ‘quishing’ (QR code tampering), fake bank attendant schemes, and AI-driven impersonation. Data from Cetic.br indicates that approximately 32% of internet users, or 45 million people, have faced at least one attempt to steal personal information, with messaging apps being the most frequent channel for 84% of victims. In response to these threats, security protocols emphasize that mobile users should immediately block devices and SIM cards following theft to mitigate losses. To contest unauthorized transactions, users are advised to provide banks with specific details, such as dates and destination accounts, alongside police reports. While reimbursement is not automatic, the responsibility often depends on the bank's security analysis. Legal frameworks are also clarifying institutional accountability. In Brazil, the Superior Court of Justice (STJ) has established through Precedent 479 that banks are objectively liable for damages caused by internal fortuity related to fraud and crimes committed by third parties within banking operations. ~~This implies institutions may be held responsible if fraud~~ To combat SMS-based scams, the Brazilian National Telecommunications Agency (Anatel) has introduced new regulations targeting Application-to-Person (A2P) SMS. Mobile operators must now block messages from unregistered short codes and ensure each code is linked to ~~inherent risks of financial activities or failures to identify transactions that deviate significantly from~~ a ~~consumer's habitual pattern.~~ single legal entity. Anatel also mandated a centralized, public sector directory for these codes to help users verify senders. Service providers have 90 days to implement these security measures and monitoring mechanisms.

Versions

Select a version to see what changed compared to the one before it.