Digital financial scams: how to avoid and respond to them

Most digital financial scams in Brazil do not break the bank’s encryption. They break the routine of the person on the other end. The scammer creates a sense of urgency, poses as someone trustworthy and leads you to make, with your own hands, the transfer they want.

That is why digital financial security is less about sophisticated technology and more about recognizing patterns. This article brings together the most common scams according to official and banking-sector sources, the habits that reduce risk and what to do, in order, if the worst happens.

Why scams work

The technical name for the method is social engineering: manipulating a person into handing over data or taking an action that benefits the criminal. The security guide from CERT.br, the incident response center linked to NIC.br (the body that manages Brazil’s internet domain), sums up that fraudsters manipulate people’s emotions and also exploit security gaps to carry out scams (CERT.br, Golpes: Evite Fraudes).

Three ingredients appear in almost every script:

• False authority: the caller claims to be from the bank, the police, a store or a relative.
• Urgency: your account “has been hacked”, the purchase “must be canceled now”, the relative “is in trouble”.
• A channel outside the victim’s control: a link, a toll-free number received by message, an app recommended by the scammer.

Pix, Brazil’s instant payment system, comes into this story because it is fast. The Central Bank says its systems have never suffered successful attacks, but acknowledges that frauds, scams and attacks on participating institutions have increasingly used Pix as a means of moving funds (Banco Central, Relatório de Gestão do Pix 2023-2025). In other words, the problem is rarely Pix being hacked, but rather someone being persuaded to use it.

The most common scams and how to spot them

Fake call center

Someone calls claiming to be an employee of your bank and warns that your account has been hacked or cloned. From there, they ask for personal and financial data. In one variation, they ask you to call the number printed on your card, but stay on the line simulating the service and capture the password you type, according to Febraban, the Brazilian federation of banks (Febraban, Golpe da falsa central de atendimento).

The federation’s advice is to hang up immediately and contact the bank at its official number using another phone. The reason for switching devices is precisely to prevent the scammer’s call from staying “stuck” on the line.

Fake courier and fake police officer

The script starts the same way: a call says your card has been cloned. The scammer asks for the password, tells the victim to cut the card and sends someone to pick it up at home. The chip, still intact, is later used in transactions. Febraban warns that no bank asks for the card back or sends a courier to collect it (Febraban, Bandidos usam novas abordagens para golpes antigos).

Remote access app

On the pretext of “fixing a security problem”, the scammer asks you to install an app. That program gives them access to your phone. Febraban calls this the “ghost hand” scam and stresses that banks do not call asking you to install an app, share a password or card number, or make a transfer (Febraban).

CERT.br adds that an app of this kind may be malware, that is, a malicious program capable of capturing data and interfering with banking apps, changing amounts and Pix keys without you noticing (CERT.br, Golpes: Caiu? Veja o que Fazer).

Account takeover and fake relative

In an account takeover, the criminal obtains your password or a verification code and starts acting as if they were you: transferring money, taking out loans or using your profile on messaging apps to ask your contacts for Pix payments.

A well-known variation is the “relative with a new number”. The person in the photo is someone you know, but the number is different. CERT.br recommends confirming through the usual contact before transferring any money and not saving the new number without checking (CERT.br, Golpes: Evite Fraudes).

Pix sent “by mistake” with a request to return it to another account

You receive an unexpected Pix and then someone asks you to return the amount to a different account. CERT.br explains the trap: if the money does not go back to the original account, the scammer can request a refund through the official return mechanism and you end up paying twice. The advice is to check your statement to see whether the Pix really arrived and to use the return option in your own app, without making a new Pix (CERT.br).

Tampered QR codes and payment slips, fake stores and fake investments

Scammers swap QR codes in public places, send fake bills by message and create stores with prices far below market. Before paying, CERT.br recommends checking the amount, name and CNPJ (Brazil’s company registration number) of the recipient (CERT.br).

“Unmissable” investment offers that push you to decide quickly also appear on Febraban’s list (Febraban). When the promise involves crypto assets, the patterns are similar and are detailed in the article on crypto scams.

Habits that reduce risk

No single measure eliminates the risk. A set of simple habits, however, closes the most commonly used doors:

1. The phone rule: banks do not ask for a password, card number, verification code, app installation or transfer. Whenever you get any of these requests, hang up and contact the bank through a channel you opened yourself (Febraban).
2. Two-step verification on email, messaging apps and important accounts, and never pass on codes received by text message (CERT.br).
3. Apps and websites only through official channels: type the address in the browser and install apps only from the official store, checking the developer.
4. Confirm before paying: the recipient’s name and CNPJ on the Pix, the QR code and the payment slip (boleto).
5. Adjust your Pix limits. Under Central Bank rules, institutions must allow you to set your Pix limit to zero. Since November 2024, transactions by individuals initiated on an unregistered device are limited to R$ 200 per transaction and R$ 1,000 per day (Banco Central, Relatório de Gestão do Pix). A lower nighttime or daily limit reduces the maximum loss from a scam.
6. Protect your CPF (Brazil’s individual taxpayer number): CERT.br recommends activating BC Protege+, a Central Bank service that makes it harder to open accounts in your name, and CPF protection on Redesim, against companies being opened with your data (CERT.br).
7. Agree on a “family password”: a question only close relatives can answer helps dismantle the fake relative scam.

What the MED is and what changed in 2025 and 2026

The Mecanismo Especial de Devolução (MED, Special Return Mechanism) is the set of Pix rules that allows funds to be blocked and transferred amounts to be reclaimed in cases of scams, fraud or crime. It has been in operation since 2021, according to the Central Bank (Relatório de Gestão do Pix).

Two recent changes matter to you:

• Dispute button. In October 2025, MED self-service came into force: a function within the Pix area of your bank’s app to dispute a transaction and track the request without relying on a human agent (Relatório de Gestão do Pix).
• Tracing beyond the first account. BCB Resolution No. 493, of August 28, 2025, created the funds recovery feature, which traces, blocks and returns funds when fraud is suspected. It could be adopted voluntarily from November 23, 2025, and became mandatory for account-holding institutions from February 2, 2026 (BCB Resolution No. 493/2025).

Previously, the block only reached the account that received the original Pix. Knowing this, scammers quickly spread the money across other accounts, known as mule accounts (contas-laranja). With the change, the Central Bank’s system maps the paths of the money and sends automatic notifications to the banks holding those other accounts (Relatório de Gestão do Pix).

What the MED covers and what it does not

According to the Central Bank’s guide for institutions, a return request applies to any fraud involving Pix, including when you yourself authorized the transaction with a password or biometrics. This covers social engineering scams, account takeover, stolen phones, purchases in which a fraudulent seller does not deliver the product, and coercion (Banco Central, Guia do MED).

Excluded are:

• Commercial disputes: a product that is late, different from expected or that you did not like. These are resolved with the store, consumer protection agencies or the courts.
• Third parties acting in good faith: if the scammer used your money to buy something from an honest seller, that seller cannot be debited.
• Your own typing errors: a Pix sent by mistake to the wrong person is not a MED case either. The guide recommends always checking the recipient’s name before confirming.

The guide makes clear that the MED is not an automatic reversal like a card chargeback: it is not enough to not recognize the purchase; the recipient must have committed the fraud (Guia do MED).

Deadlines you need to know

• To dispute: the transaction must have taken place no more than 80 days earlier. After that, the app should say the deadline has passed.
• For your bank to act: on receiving the complaint, the bank must open the funds recovery process immediately, without assessing the merits and without requiring a police report at that point. The guide recommends doing so within 10 minutes of the end of the service call.
• For the recipient’s bank to assess: up to 7 calendar days to conclude whether there was fraud, with the amount blocked during that period.
• For the refund: once fraud is confirmed, your bank has up to 72 hours to request the return, and the recipient’s bank has 6 hours to return it in the vast majority of cases.

All these deadlines are in the Central Bank’s guide, in the version in force in October 2026 (Guia do MED). The guide is updated frequently; a new version already published provides for adjustments taking effect in September and October 2026, mainly for disputing returns.

The most important point: only whatever balance is still left in the accounts involved comes back. If the money has already been withdrawn or spent, the recipient’s bank records a refusal for lack of funds. That is why the speed of the dispute makes such a difference.

You fell for a scam: what to do in the first hours

The order below follows CERT.br guidance and MED rules. The first actions are the ones that most influence the chance of recovering money.

In the first minutes

1. Cut off contact with the scammer. Do not send more money or data, do not try to negotiate, and block the number or profile (CERT.br, Caiu? Veja o que Fazer).
2. Dispute the Pix in your bank’s app, in the Pix area, or through official service channels. Choose the type of incident and write down the reference number.
3. If it was a card, dispute the purchases and block the physical and virtual cards.
4. If you shared a password or code, change the passwords of the affected accounts, end open sessions on other devices and turn on two-step verification. Ask the bank to block access to the app if necessary.

In the following hours

5. Keep evidence: screenshots of messages, links, phone numbers, profile names and receipts. Write down reference numbers, agents’ names, dates and times (CERT.br).
6. File a police report (boletim de ocorrência) with the evidence. According to CERT.br, in most cases it can be filed online, and the report may be needed to dispute frauds and claim insurance.
7. Report the profile or ad on the social network or platform used in the scam and warn your contacts if your account was hacked.
8. If you installed an app recommended by the scammer, CERT.br recommends restoring the phone to factory settings and recovering data from a trusted backup.

In the following days and weeks

9. Track the request in the app. MED self-service should show the status of the dispute, the response deadline and the amount returned, if any (Guia do MED).
10. If the bank does not resolve it, you can file a complaint with the Central Bank, go to your state’s Procon (consumer protection agency) or consult a lawyer, as CERT.br lists. Another route is Consumidor.gov.br, a free public service monitored by Brazil’s National Consumer Secretariat, in which the company has 10 days to respond. The platform does not replace Procon (Consumidor.gov.br).
11. Monitor your financial life: statements, bills, access history and your financial records on Registrato, the Central Bank system CERT.br recommends for this check (CERT.br).

What the MED does not solve

In the editorial team’s assessment, three limits deserve attention. First, the mechanism depends on available balance: organized scammers withdraw or disperse money within minutes. Second, it does not cover errors or commercial disputes, which require other routes. Third, scams outside Pix, such as transfers to crypto exchanges abroad, follow different rules and, in practice, tend to be much harder to reverse.

Victims of attacks on companies, such as data hijacking with a ransom demand, face a different kind of problem, explained in the article on ransomware and cryptocurrency.

Key takeaways

• Digital scams exploit haste and trust. Banks do not ask for a password, card, app or transfer over the phone; hang up and contact the bank from another device.
• Lower Pix limits, two-step verification and checking the recipient before paying greatly reduce exposure.
• If you fall for a Pix scam, dispute it in the app immediately. Since 2026, the MED can follow the money across several accounts, but it only returns whatever balance is still left, within 80 days and only in cases of fraud.