A recent survey by the Brazilian Public Security Forum found that Brazilians have lost R$25.5 billion to scams using Pix and fake boletos in the last 12 months. Against this backdrop of crime migration, Silverguard analyzed thousands of reports from victims of the SOS Scam Center to carry out the second edition of the Pix Scams study.

"Pix is not the villain, but it has helped accelerate the growth of digital scams in Brazil. In 2022, my father joined the statistics: he became one of the victims and lost R$15,000. The creation of Silverguard was inspired by the hard journey of trying unsuccessfully to recover lost money. With more than 20 years' experience in technology, I put together a team of experts and, with the support of investors, we created SOS Golpe, the country's first social anti-fraud platform, which helps and connects victims to the financial system, shortening the reporting journey and increasing the chances of recovering the money lost in the scam. As part of our work, we decided to conduct a survey to understand the nuances of digital crime and, based on this knowledge, be able to help Brazilians of all ages even more. For older victims, the challenge of losing money in a scam can be even greater. Many have a limited fixed income, already committed to other expenses, and there is also the emotional trauma of having fallen for a scam where, most of the time, the fraudster posed as a family member asking to borrow money," says Marcia Netto, founder of Silverguard.

Marcia Netto points out that the challenge of Pix scams lies with society as a whole, meaning that although many people place the responsibility for prevention solely on the citizen, companies - not just banks, but also social networks and telephone companies, for example - need to accept their responsibility for what is happening in the country.

Advertising Space

"In order to carry out scams, criminals rely on a network of services: they register URLs, hire website hosting, advertise on social networks, use telephone operators, buy sponsored links and also open fake or dummy accounts at financial institutions. Scam prevention isn't just about validating an account when it's opened; a very important way of preventing a scam is to block an account used by a scammer at the first report received, but since the fraud teams of institutions - whether financial or technology - are afraid of false positives, they end up waiting until they reach a volume of scams before analyzing the case and offboarding these accounts, exposing thousands of victims to scams that could have been prevented," he says.

The Scams with Pix study reveals that among the AB class, the losses are R$6,300; among the C class, the figure is R$3,500; and among the DE class, R$1,500. The analysis by age shows that the loss of a victim aged over 60 is four times greater than that of a victim aged between 18 and 24.

Of the scams analyzed, 79% originated on Meta platforms, with WhatsApp leading the way, originating 39% of the cases, followed by Instagram (23%) and Facebook (18%). The channels vary greatly by age: while WhatsApp was the initial channel for 69% of victims aged 60 or over, Instagram was the biggest initial channel for victims under 18.

In terms of income, Facebook is the initial scam channel with the greatest variability, with 21% in the DE class and 6% in the A class. Ninety-seven percent of Pix scams are of the APP type (authorized push payment fraud), in which the user, deceived by a very convincing story, ends up transferring money directly to the fraudster, i.e. the victim of a social engineering scam.

X-RAY OF PIX SCAMS 2024 - AGE GROUPS

SCAMS BY AGE | Victims and scams that fall the hardest
The narratives, stores and products are changed every three months by the scammers, but there is always a basic strategy behind the story.
_ Under 18: buying a product or service from a fake shop/profile (58%); a fake opportunity to multiply and invest money (21%); and buying a product from a person who has had their social network hacked (7.5%).
From 18 to 29 years old: buying a product or service from a fake shop/profile (52%); false opportunity to multiply and invest money (16.5%); and false job and income opportunity (6%).
From 30 to 39 years old: buying a product or service from a fake shop/profile (42%); false opportunity to multiply and invest money (16%); and false opportunity for employment and income (10%).
From 40 to 49 years old: buying a product or service from a fake shop/profile (41%); false opportunity to multiply and invest money (13%); and impostor asking to borrow money and/or help (11%).
From 50 to 59 years old: buying a product or service from a fake shop/profile (35%); impostor asking to borrow money and/or help (27%); and scam from a fake bank call center (8%).
Over 60s: imposter asking for money and/or help (48%); buying a product or service from a shop/fake profile (18%); and scam from a fake bank call center (7%).
The amount of damage suffered by a victim aged over 60 is four times greater than that of a young person aged between 18 and 24, and 16 times greater than that of a victim under 18.
In the other age groups, the average loss is:
Under 18: R$ 270
18 to 24: R$ 1,046
25 to 29 years: R$ 2,165
30 to 39 years: R$ 2,530
40 to 49 years: R$ 2,885
50 to 59 years: R$ 2,400
60+: R$ 4.200
INITIAL SCAM CHANNELS

All age groups

Most common scams: According to reports from SOS Golpe, Silverguard's social anti-fraud platform, the most common Pix scams are: buying a product or service from a fake shop/profile (45%); fake opportunity to multiply or invest money (15%); and impostor asking to borrow money (10%). The order of the most frequent scams varies according to the age and social class of the victim.

Scams by social class (Types and Amounts Lost): Although Brazilians from all social classes are targets of the fake purchase scam, some tactics are more common and with greater losses for classes AB, C or DE. The average loss from a Pix scam is R$ 2,100 (1.5 x higher than the minimum wage); in the case of victims from class AB, the loss is R$ 6,100; in class C, R$ 3,500; and in DE it is R$ 1,500.

Class AB: the average loss from the scam to multiply money/fake investment is R$ 28,700; fake loan (R$ 23,600); and request for surgery/treatment for an acquaintance (R$ 12,900).

_ Class C: the average loss from the fake job or extra income scam is R$9,800; multiplying fake money/investment (R$9,600) and paying to receive an undue balance/money (R$6,700).

Class DE: the average loss from the fake job or extra income scam is R$3,200; impostor asking for money or help (R$2,200); multiplying fake money/investment (R$2,000).

Average financial losses per tactic

The research coordinators stress that victims don't just lose money. "The feeling of being scammed carries intense emotional triggers, often causing profound impacts on family relationships and, in extreme cases, leading to depression and even suicide. Taking care of those who have fallen victim to a scam is essential, especially older people, who often lose the reserves they have accumulated over a lifetime and don't have time to recover the money lost," says Marcia Netto.

The ranking is calculated by the number of victims divided by the total number of Pix transactions carried out per state from January to June 2024.

Channels from which scams originate: 79% of Pix scams originate from Meta platforms, with WhatsApp leading the way - originating 39% of cases - followed by Instagram (23%), Facebook (18%), Telegram (7%), YouTube (5%) and phone calls (1.6%).

Highlights: 69% of victims over the age of 60 were tricked by scams initiated on WhatsApp. Among those under 18, 36% fell for scams on Instagram, however, TikTok is growing and already accounts for 9% of scams in this age group.

Facebook is the initial channel for scams that shows the greatest variability, with 21% in class DE and 6% in class A.

Phone calls are the channel with the greatest financial loss, with an average loss of R$5,100; one in four of these calls are spoofing calls, in which the scammers manage to impersonate a known number.

Mapping the profile of digital scammers

Corporatization of the digital financial scam: According to Marcia Netto, CEO of Silverguard, Brazil is witnessing, in real time, the corporatization of the digital financial scam.

"This is a phenomenon that, while bringing the many 'scam professionals' under the same umbrella, does not completely unite them and does not create guidelines or guidelines for action," she analyzes.

Equipped with new tools, scammer 2.0 escapes the stereotype built up in the collective imagination of the hacker - a young person who "understands technology and takes advantage of opportune situations. Today, the great threat is entrenched in a corporate structure that is still being formed, which is diverse and goes under the radar of general knowledge. With the abandonment of firearms, the invisibility of non-physical violence shields these "agents" both from their own guilt and from the legal authorities.

"There are those who operate on a small scale, taking advantage of loopholes in the real world; others develop scripts and sell scripts and technologies for third parties to buy and replicate their scams. And finally, there are those who go further, creating real criminal institutions, with hired employees, hiring processes, HR, targets and even structured financial departments," he points out.

Profiles

Based on reports received via SOS Golpe, interviews with experts and studies on scams around the world, the research lists criminal profiles and proposes a new lens through which to analyze "scam professionals" and their various spheres.

Raul: The scammers who became known for traveling around Brazil in groups, running scams far from home. Traditionally, Raul's job was to find loopholes to circumvent ATM systems and trick elderly people who couldn't operate self-service. Today, criminals with this profile are modernizing their scams with the game of tiger and bets. Raul is known as an ostentatious scammer, part of a new cultural movement of ambition that is emerging: young people see scams as a safer and more legitimate way of rising up the social ladder - without having to take up arms or get involved with drugs. Raul has already entered the aspirational dream profession, alongside influencers and soccer players; this figure is present in funk lyrics and there are even those who are "Raul açucarado" on social networks.

Script Kiddie: Usually minors who buy tools and scripts, they copy codes found on forums or online tutorials, known as scams-as-a-service, to apply the scams. Without much technical knowledge, they reproduce already known scams or look for flaws in highly accessed websites and systems.

Banker: Specialists in hacking virtual banking systems, telephone systems and collecting card data from third parties, respectively. They use a combination of social engineering techniques and technological skills to defraud victims and systems and make a profit.

Cracker: With unparalleled technical competence, they use their advanced skills for malicious purposes via digital means (as opposed to "hackers" / "white hats"). They create and sell malware and can operate in networks for more complex and planned attacks.

Criminal organizations: In addition to the violent crimes carried out in the more urbanized areas of the country, organized crime is penetrating the digital payment system, operating transactions and relying on its own financial institutions.

Methodology

The Scams with Pix 2024 study, carried out by Silverguard in October 2024, was conducted in three phases. In the first, the Access to Information Act (LAI) was used to obtain unpublished data from the Central Bank on Pix's Special Return Mechanism (MED) requests in 2023.

In the second phase, the researchers analyzed 5,000 complaints from victims assisted by the SOS Scam Center, with complete demographic profiles. The sample was 60% female and 40% male. In terms of social class, 4% were from class AB, 25% from class C and 71% from class DE. In terms of age group, 4% were under 18; 42%, 18 to 29; 25%, 30 to 39; 17%, 40 to 49; 8%, 50 to 59; and 5% were over 60. The third phase involved exclusive interviews with 16 national and international experts in the anti-fraud sector.

Pix: Another BC leak?

A total of 1,378 Pix keys belonging to clients of Cronos Instituição de Pagamento were leaked, the Central Bank (BC) said on Tuesday. This was the 17th incident involving Pix data since the launch of the instant payment system in November 2020, and the 12th this year alone.

According to the Central Bank, the leak took place between November 5 and 8 and included the following information: user name, CPF, relationship institution, branch and account number.

The incident, the Central Bank pointed out, happened because of occasional failures in the payment institution's systems. The leak occurred in registration data, which does not affect the movement of money. Data protected by banking secrecy, such as balances, passwords and statements, were not exposed.

Although the case didn't need to be reported because of the low potential impact on customers, the authority clarified that it decided to disclose the incident in the name of its "commitment to transparency".

Anyone whose information was exposed or leaked will be notified via the institution's app or internet banking. The Central Bank stressed that these will be the only means of warning of the exposure of the Pix keys and asked customers to disregard communications such as phone calls, SMS and warnings via messaging apps and email.

Data exposure does not necessarily mean that all the information has been leaked, but that it has been visible to third parties for some time and may have been captured. A leak indicates that someone has accessed the data.

Investigation

The Central Bank said the case will be investigated and sanctions may be applied. The legislation provides for a fine, suspension or even exclusion from the Pix system, depending on the seriousness of the case.

In all of the 17 incidents involving Pix keys recorded so far, registration information has been exposed, without the exposure of passwords or bank balances. As determined by the General Data Protection Law, the monetary authority maintains a page where citizens can monitor incidents related to the Pix key or other personal data held by the Central Bank.

In a statement, fintech Cronos said that the exposure was caused by a single account holder, who took advantage of "monitoring failures" to consult Pix key data. According to the financial institution, the account holder was notified and had his account closed.

"Due to the security protocols maintained by the company, this customer did not have access to passwords, financial transaction data or any other information that is subject to banking secrecy," reiterated Cronos Instituição de Pagamento.

With Agência Brasil