Brazil tightens Pix rules over deepfake fraud

Brazil recorded an 830% jump in financial scams using deepfakes, according to a study cited by SITEPD. The same report said 42.5% of financial fraud cases recorded in the country in 2025 used some type of artificial intelligence tool. At the same time, the Central Bank updated the rules against fraud in Pix.

What do the data show about the rise of synthetic fraud?

The figures point to a change in scale in the use of synthetic identity across Brazil’s financial system. Consolidated data from digital identity company VU, the Federal Police and Febraban show that synthetic content now accounts for about 1 in 15 financial fraud cases detected in Brazil in 2026, or 6.5% of the total.

That share is far above the 0.1% recorded in March 2025, according to the same dataset cited by TI Inside. The coverage also says digital scams in Pix have shifted from basic visual errors to methods based on synthetic identity, marking a technical change in how the schemes are carried out.

What changed in Pix regulations?

The Central Bank’s new resolution toughens the treatment of keys and data linked to fraud in Pix. According to Money Times, institutions that accept a violation notice or register a founded suspicion mark are now explicitly responsible for that mark for up to five years.

The rule also requires users to be notified, channels for review to be offered, and requests to be answered within a maximum of seven days. It also requires the mark to be removed when there are no elements supporting the suspicion. Poder360 added that Pix participants can flag CPFs or CNPJs tied to specific transactions as suspected fraud and reject future operations associated with those credentials.

What economic impact is attributed to these scams?

Coverage from IPNews and Portal do Holanda reported that financial scams using AI and deepfakes caused estimated losses of R$ 1.8 billion to Brazilian banks and financial infrastructure between July 2025 and April 2026. It is the first cited estimate in these reports on the cost of the move toward identity-based fraud.

On the regional front, a technical panel presented at Febraban Tech 2026 and cited by Central do Varejo said deepfake attacks already account for about 48% of fraud incidents in Latin America, compared with a global average of 23%. That reading was used to explain proof-of-life testing pilots with AI at fintechs such as PicPay.

What other obligations did the Central Bank add?

Agência Brasil and Campo Grande News detailed that, in addition to tightening the treatment of keys and CPF records marked for fraud in Pix, as of February 2027 financial institutions must also notify individual account holders of any security incident affecting personal data linked to Pix infrastructure.

TI Inside and Money Times also noted that the participant that flags a fraud suspicion must keep detailed records of the grounds behind the decision. That formal record will be available for investigations by the Federal Police and Febraban into digital fraud patterns and synthetic identity in the financial system.