Digital security guide: the most common scams in Brazil and how to avoid them

Crime has moved to the cellphone screen. In a country with over 100 million connected people, where WhatsApp is present on the vast majority of smartphones and Pix has become the everyday payment method, digital scams have become one of the most common forms of property crime in Brazil. The good news: almost all frauds follow known, repetitive scripts. Those who learn to recognise the plot are unlikely to fall for it. This guide gathers the most frequent scams in the country, explains how each works internally and builds, step by step, a layered defence accessible to anyone.

Why Brazil became a preferred target

Three factors explain the explosion of digital fraud here. First, the massive and rapid adoption of technology: in a few years, banking, shopping, work and family conversations have all shifted to the cellphone. Second, Pix, launched by the Central Bank in 2020, which transfers money in seconds, at any hour — a convenience revolution that also accelerated losses when victims are duped. Third, the weakest link in any system: the human factor. The overwhelming majority of scams do not breach any system; they persuade the victim themselves to hand over a password or make a transfer. This is what experts call social engineering — the art of manipulating people using urgency, fear or greed.

The scams that victimise the most

The fake relative on WhatsApp

The criminal uses a photo of the victim’s child, sibling or friend and messages from an unknown number: “I changed my number, Mom.” Then they invent an emergency — a bill due, a payment that can’t be delayed — and ask for a Pix. The most serious variation is real account cloning: the scammer obtains the victim’s WhatsApp verification code, takes over their app, and asks contacts for money using the genuine number. The defence is simple and foolproof: before transferring any amount, call the person’s old number or make a video call. Send money only after hearing the voice.

The fake bank call centre

The victim receives a call from someone claiming to be a bank employee and warns about a supposed suspicious purchase. The fake agent knows the full name and CPF — data that circulate in leaks — which adds a veneer of authenticity to the act. From there, the script varies: they ask for the password to cancel the transaction, instruct the victim to transfer the money to a “secure” account, or even send a courier to collect the card. Memorise one rule: no bank ever calls asking for a password, code, transfer or to return a card. If you receive such a call, hang up and call the official number printed on the back of the card yourself.

Phishing: the link that fishes for your data

Email, SMS or WhatsApp messages imitate well-known companies — banks, retailers, carriers, public agencies — and push a link to update a registration, release a held parcel or claim a prize. The link leads to a fake page, a faithful copy of the real one, that captures login and password. Be suspicious of any message that combines urgency with a link; scrutinise the website address carefully, character by character; and if in doubt, access the service by typing the official address yourself in the browser or opening the app.

Fake boleto and tampered QR Code

Scammers issue boletos that look identical to the legitimate ones, changing only the beneficiary, or they tamper with payment codes. Before paying, check whether the beneficiary name shown in the bank app’s confirmation matches the correct company. With Pix, the same rule applies doubly: the confirmation screen always displays the name of the recipient — read it before authorising.

Ghost stores and miracle offers

Social-media profiles and newly created websites advertise products with irresistible discounts, receive the payment — almost always via Pix — and then disappear. Before buying, search the store’s name together with the word “complaint”, verify that the site has a real CNPJ and address, and be wary of prices far below market. A price that’s too good to be true is usually exactly that: a lie.

Fake job and fake investment

Easy-income offers arrive via message: simple tasks paid daily, investment platforms promising guaranteed profit, schemes that require an upfront deposit to unlock earnings. The mechanism is the same as old pyramid schemes: you pay a little at the start to win trust, and when the victim stakes big, the money vanishes. No serious investment promises a guaranteed return, and no legitimate job requires you to pay to start working.

Your layered defence

1. Enable two-step verification on WhatsApp, email and banking apps. This second password blocks most cloning attempts, even if the criminal discovers the code sent via SMS.
2. Use long, unique passwords for each service. A password manager solves the memorisation problem; the same password reused everywhere is an open pass for the criminal.
3. Lower Pix limits, especially during nighttime, and set smaller limits for unknown contacts. In case of a scam or rapid hijack, the loss is contained.
4. Fortify your phone: use biometrics or a strong lock-screen password, enable additional passwords within financial apps and disable notification previews on the locked screen.
5. Never install apps or click on links received by message, even if they appear to come from companies or public agencies. Scammers use remote-access programs to control the victim’s device while they watch the balance disappear.
6. Beware of haste. Urgency is the raw material of every scam. Any story that demands an immediate financial decision deserves a pause, a confirmation call, and a second opinion.

I fell for a scam. Now what?

Acting quickly makes a difference. Immediately inform your bank and request a transaction dispute — for Pix, there is the Special Refund Mechanism, created by the Central Bank, which allows blocking funds in the scammer’s account when the fraud is reported promptly. File a police report, which can now be done online in most states, keep all evidence — chats, receipts, phone numbers — and alert your contacts if your WhatsApp has been cloned, so nobody transfers money in your name. Victims of data leaks should also change passwords and monitor CPF activity.

Security is a habit, not paranoia

No protective technology can replace vigilant behaviour. Scams change their guise each season — sometimes using the name of a government programme, other times a holiday promotion — but the skeleton is always the same: an unknown person creating urgency to separate you from your money or passwords. Those who internalise the basic rules — confirm by voice, never give a password over the phone, read the recipient’s name before a Pix, distrust easy profit — turn the phone from a crime entry point into a safe tool. Share this guide with those you love, especially the older and younger members of the family: information, in the end, is the most effective antivirus there is.