Brazil Open Finance and Deepfake Fraud

Operation Timeline

Attack Chain and TTPs

The pattern seen in the material is consistent with a modular attack chain. The first step is usually initial access through social engineering, phishing, smishing, vishing or in-person approaches. In Brazil, Exame warns that many Open Finance scams use real data such as name, CPF, address and purchase history to make consent requests more believable. The opening phase is not meant to force a complex technical intrusion, but to get a user action, a code, an approval or a session opening.

Then comes the stage of impersonation or abuse of valid accounts. MITRE defines the Valid Accounts technique as the use of compromised legitimate credentials to access systems. In the Brazilian corpus, that translates into account takeover, digital identity hijacking, access to GOV.BR, credential reuse and opening financial products in the victim's name. The operation can continue with contact changes, diversion of authenticators, Pix key portability or opening mule accounts to move the money.

The second major block is biometric control evasion. Diário do Nordeste, Metro1, CNN Brasil, Itaú Unibanco and IT Section describe deepfakes, manipulated selfies, synthetic videos and injection techniques used to bypass liveness checks and facial recognition. The goal is not just to look real, but to produce a signal that the automated system will accept. Correio 24 Horas even reported a case in Bahia where photos of elderly faces were used to defeat facial recognition in banking apps and take out loans.

At this point, MITRE's Masquerading technique fits well. The attacker uses false identities and appearances to evade defenses. The forgery can be documentary, biometric or contextual. Several reports also mention combinations of photo, audio and video, suggesting campaigns that combine credentials, audiovisual impersonation and onboarding manipulation.

The third block is monetization. Transfers through Pix appear, along with fraudulent loans, movements into third-party accounts, account draining and the use of fake boletos. Agência Brasil and Quod's research shows that Pix was the dominant channel. The Operação Infiltrados case, with about R$ 45 million diverted, and the arrest of an employee suspected of diverting about R$ 2 million, illustrate that monetization can rely both on automated channels and on internal abuse.

Persistence is usually completed through laundering and fragmentation. Evertec describes criminal organizations with divided functions across social engineering, malware, money laundering, mule accounts, document forgery and data trafficking. That matters because it explains why the attacks no longer look like isolated acts, but like specialized services. The Fraud as a Service model lowers the barrier to entry for smaller groups and professionalizes the operation.

Regional Impact

Regional Overview

The Brazilian case matters for the rest of Latin America because it combines three elements that do not always appear together. First, highly integrated payments and data infrastructure, with Open Finance, Pix and interconnected fintechs. Second, growing use of generative AI for identity fraud, deepfakes and impersonation. Third, a regulatory response that moves quickly, but still depends on banks, vendors and authorities coordinating technical controls in real time.

The link between identity and fraud is no longer purely documentary. The reports cited show that the industry has started treating facial biometrics, liveness checks and digital consent as attack surfaces. At the same time, organized crime works with access to leaked data, targeted social engineering and session hijacking. That combination repeats, with variations, in several countries across the region, although Brazil contains the deepest body of material collected.

Brazil

Brazil is the center of the report. Evertec Trends, Exame, Agência Brasil, Quod, CNN Brasil, Serasa, O Globo, IT Section, Itaú Unibanco, Metro1, Diário do Nordeste, the Federal Police, the Central Bank and ANPD all point to a consistent picture. Fraud has moved from card misuse and boletos toward an environment where attackers exploit Open Finance, Pix, digital identity and facial biometrics.

The scale data is striking. More than 9 million signs of fraud in the first half of 2026, 78% via mobile phones, 85% involving Pix and about 40% stemming from social engineering. On top of that, Fenasbac and GASA estimate more than 24 million victims of Pix and boleto scams between July 2024 and June 2025, nearly R$ 29 billion in losses and a 43% increase in Pix-related losses compared with 2023. ANPD, for its part, said Brazil accounted for 39% of Latin America's deepfake cases in 2025 and saw a 126% year-over-year increase in attacks using fake images, voices and identities.

The operational picture reflects that scale. The material includes fraud in Caixa social benefit accounts, fake account openings, fraudulent loans, diversions in beneficiary accounts, internal abuse by bank employees and a major historical fraud case, Bank Master, which Insight Crime links to criminal networks and militias. The combined reading is that Brazilian financial fraud is no longer dependent only on the classic digital perimeter and has moved into the trust chain that supports the payments system.

Colombia

Colombia appears in the material with a more visible regulatory and preventive agenda. Law 2573 of 2026, according to El País, suspends collections and temporarily removes negative credit reports for identity theft starting in November 2026. The Financial Superintendency created a dedicated space to guide the public on phishing, smishing, vishing, identity theft and friendly fraud, with recommendations to report immediately, deactivate products and file complaints with police and prosecutors.

The practical risk, however, is already showing signs similar to Brazil's. TintaTIC describes more than 218,000 complaints for identity theft and highlights the opening of digital accounts with stolen data and the creation of altered records. Semana warns about email, voice and video deepfakes that imitate banks or trusted people. Pulzo warned about smishing tied to the launch of Bre-B, with fake messages asking for passwords, codes and even biometrics. BBVA Colombia, meanwhile, recommends enabling biometric authentication and checking suspicious notifications through the official app.

The case block is also strong. El Espacio Digital reported a fake bank adviser in Bogotá who extracted data for credit card fraud. La FM described a digital wallet scam that uses stolen identities and transfers "by mistake" to load debt onto the victim. Creditolab and Juan Antonio Matiz collect response steps such as reporting to prosecutors, contacting the bank, blocking cards, reviewing credit reports and acting on possible SIM swapping. Overall, the country shows a mix of regulatory controls, user education and warning signals against impersonation and onboarding fraud.

Mexico

Mexico shows a parallel technical pattern, though with less regulatory detail in the material. Condusef reported 43,871 complaints for attempted financial fraud in the first half of 2026, a 16.7% year-over-year increase, and 118,287 total reports, up 11.3% from a year earlier. Shufti Pro says the country faces account takeover, SPEI payment manipulation, social engineering and cartel-linked laundering. That points to convergence between financial fraud and organized cybercrime.

Juan Guevara, cited by Imagen Radio, described an injection attack technique in account-opening processes through mobile apps. The attacker interrupts the camera and replaces the feed with a fake AI-generated video to fool the selfie or video system. The same corpus mentions a sharp increase in digital account-opening fraud and account takeover, although those percentages are attributed by the sources and should not be treated as an official consolidated series in this report.

Banorte responded with a dual-security strategy based on verifying phone lines with telecoms and behavioral biometrics that analyze geolocation, device use and other patterns. Xataka México adds that CNBV approved changes allowing identification with official documents, fingerprints and facial recognition, especially for level 3 and 4 accounts, and that cash deposits or withdrawals above 140,000 pesos must be supported by biometrics. MITRE fits the Mexican picture well, because the material reflects initial access by social engineering, use of compromised valid accounts and masquerading through deepfakes or synthetic identities.

Technical Indicators

No classic technical IOCs were published in the consolidated material, such as hashes, IPs, domains, malicious URLs or malware artifacts. The corpus does provide operational and contextual indicators that help profile the campaigns.

Analysis for Security Teams

The main operational lesson is that defense can no longer depend on one layer. In Brazil, attackers combine induced consent, credential compromise, biometric manipulation and fast monetization through Pix or credit. That forces detection to move from the isolated event to the full sequence of behavior.

For anti-fraud teams, the first focus should be the consent flow. If Open Finance relies on valid user authorizations, telemetry must detect deviations in the onboarding experience, session hijacking, sudden device changes, unusual hours, abnormal network origin and the reuse of leaked real data to trigger requests. The material suggests that many attacks go undetected because the operation looks authorized. The quality of consent matters, not just its existence.

The second focus is biometrics. Selfie, video and proof-of-life flows need controls against injection, deepfakes and document manipulation. IT Section says remote validation already requires specific mechanisms against deepfake and biometric injection. Practically, identity validation should not depend only on a frontal image, but on multimodal biometrics, liveness signals, comparison with trusted databases and contextual analysis. CNN Brasil and ClickPetroleo e Gás / Exame cite multimodal biometrics and 3D liveness as the response needed to keep a synthetic face from passing as real.

The third focus is instant payments. The Central Bank has already tightened rules, but the attacker's ability to move money quickly remains the core risk. That is why prior verification of CPF and CNPJ, account holder name and transaction behavior should be integrated before enabling Pix keys, porting keys or accepting transfers to accounts under suspected fraud. Resolution BCB No. 501/25 and related rules show the regulator pushing detection to the point before or immediately after authorization, not just to the later chargeback stage.

The fourth focus is organized fraud. Evertec describes a structure with specialists split by function. That means defenses have to treat the problem as a criminal supply chain. It is not enough to block the deceived user. Teams also need to identify mule-account networks, reused devices, affiliation patterns across accounts, repeated use of synthetic identities, recycled passwords and coordinated funnel behavior. The objective is to break the scale economics of fraud, not just respond case by case.

At a prioritization level, teams should treat three scenarios as high priority. First, remote onboarding with selfie or video. Second, consent authorization or Pix key approval from new devices or hijacked sessions. Third, loan requests or account openings using leaked real data and signs of social engineering. In those cases, added friction such as step-up challenges, second-channel verification, manual review or temporary suspension appears justified by the risk level shown in the material.

It also makes sense to link fraud and cyber security more closely. MITRE helps organize the analysis. Initial Access covers entry through phishing or smishing. Valid Accounts explains the use of compromised legitimate credentials. Masquerading reflects deepfakes and visual impersonation. Applied to banking fraud, that taxonomy gives anti-fraud, SOC, IAM, risk and compliance teams a shared language.

Material Limitations

The material does not include exploitable technical indicators of criminal infrastructure, such as IPs, hashes, domains or malware samples. It also does not contain one end-to-end case with the full chain confirmed from initial access to monetization. What is available is a strong combination of technical, regulatory, judicial and journalistic reporting that makes it possible to reconstruct patterns, but not to attribute a single unified campaign with certainty.

Several figures are attributed by the sources themselves rather than by primary documents accessible in the corpus. That applies to some percentages reported by media outlets on deepfake growth, account takeover or digital account opening. This report preserves that uncertainty where needed.

The geographic coverage is uneven. Brazil contains most of the verifiable material and therefore structures the main analysis. Colombia and Mexico provide enough facts for a comparative reading. Argentina, Chile, Paraguay, Bolivia, Peru, the United States and Uruguay did not contribute additional verifiable facts within the consolidated research, so they are not developed as separate subsections.